15927 matches found
Command Injection
Overview django-pyas2 is an AS2 file transfer Server built on Python and Django. Affected versions of this package are vulnerable to Command Injection via the cmdreceive and cmdsend fields in the Partner model, which are passed directly to the os.system function without sanitization. An attacker...
PocketSphinx: Buffer overflows in language and acoustic model loading code
Impact The trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files. In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer...
Heap-based Buffer Overflow
Overview pocketsphinx is an Official Python bindings for PocketSphinx Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the model loading process. An attacker can execute arbitrary code or cause a crash by supplying a crafted or malicious language or acoustic mode...
GHSA-56R5-2P2F-7CXP PocketSphinx: Buffer overflows in language and acoustic model loading code
Impact The trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files. In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer...
Server-side Request Forgery (SSRF)
Overview meta-ads-mcp is a Model Context Protocol MCP server for Meta Ads - Use Remote MCP at pipeboard.co for easiest setup Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the uploadadimage process. An attacker can cause the server to make arbitrary...
Allocation of Resources Without Limits or Throttling
Overview mcp is a The official Ruby SDK for Model Context Protocol servers and clients Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the handleinitialization path of lib/mcp/server/transports/streamablehttptransport.rb, which creates a...
Allocation of Resources Without Limits or Throttling
Overview mcp is a The official Ruby SDK for Model Context Protocol servers and clients Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the handlepost method of lib/mcp/server/transports/streamablehttptransport.rb, which reads the entire...
New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens
A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator's own dashboard claims 3,811 unique AWS keys. A Shodan harvester keeps the scan queue stocked with ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio: the image generators, local model runners, an...
vLLM has Remote DoS via Invalid Recovered Token Reinjection
Summary A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to vocabsize, convert that value to -1 when choosing the next live token for a request, and then feed that -1 back into the next drafter input ids. On Qwen3 GPTQ this reach...
GHSA-8WR5-JM2H-8R4F vLLM has Remote DoS via Invalid Recovered Token Reinjection
Summary A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to vocabsize, convert that value to -1 when choosing the next live token for a request, and then feed that -1 back into the next drafter input ids. On Qwen3 GPTQ this reach...
EUVD-2026-18522
vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models...
MINI-754W-QH2M-3FRF
Bulletin has no description...
MINI-R88R-7M75-P2J9
Bulletin has no description...
MINI-3225-G9HP-39WM
Bulletin has no description...
MINI-477R-2XJ4-92WH
Bulletin has no description...
MINI-VM5C-P9Q4-5M8R
Bulletin has no description...
MINI-W79R-M6CC-JJ59
Bulletin has no description...
CVE-2026-41842
A flaw was found in the Spring Framework. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exploiting how Spring MVC and WebFlux applications resolve static resources. This can lead to the affected application becoming unavailable. Mitigation Mitigation for this iss...
