9953 matches found
CVE-2026-100674
stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create...
CVE-2026-100649
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...
CVE-2026-100674
The stoatchat application (versions prior to 0.15.5 ) is vulnerable to a username validation bypass due to insufficient revalidation after Unicode sanitization . An attacker can submit Unicode letters that transform into forbidden characters post-sanitization, allowing them to bypass character al...
EUVD-2026-87768
stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create...
EUVD-2026-87743
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...
CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...
CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...
CVE-2026-100649
Versions of vLLM prior to 0.29.0 are vulnerable to a resource-limit bypass within the PyNvVideoCodec decoder allocation. The root cause is sampler subclass shadowing , which allows for independent counter increments rather than global tracking. An unauthenticated remote attacker can exploit this ...
CVE-2026-14840
CVE-2026-14840 — YOP Poll 7.0.6 Vote Limit Bypass Author: nullwhisper Use case: authorized security research / vulnerability validation only. What is this? YOP Poll plugin versions 7.0.6 enforce a one-vote-per-IP limit. The problem is that to obtain the client IP it checks HTTPCLIENTIP and...
CVE-2026-100571
OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...
CVE-2026-100572 OpenClaw before 2026.8.1 Denial of Service via Rate Limit
OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...
CVE-2026-100571 OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass
OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...
EUVD-2026-87480
OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...
CVE-2026-100571
The OpenClaw npm package (openclaw) versions >= 2026.6.6 and
CVE-2026-100571 OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass
OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...
CVE-2026-100571 OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass
OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...
CVE-2026-100542 OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2
OpenClaw npm package 'openclaw' versions = 2026.5.28 and 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained...
CVE-2026-100542 OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2
OpenClaw npm package 'openclaw' versions = 2026.5.28 and 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained...
CVE-2026-100542 OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2
OpenClaw npm package 'openclaw' versions = 2026.5.28 and 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained...
CLEANSTART-2026-FL18888 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures
Security vulnerability affects the loki package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...