lm-fingerprint

LM-Fingerprint Fingerprints the serving stack behind an OpenAI-compatible chat endpoint. It records tokenizer accounting, hidden template offset, validation prose, JSON/SSE shape, role acceptance, named limits, and gateway headers. It does not load weights, store API keys, or ask the model who it...

TS_LLMLib

tsllmlib - TrustedSec LLM 라이브러리 TrustedSec LLM Library 는 도구 사용을 지원하는 로컬 LLM과 상호작용하기 위한 Python 라이브러리입니다. 로컬 LLM 엔드포인트와 MCPModel Context Protocol 통합을 활용하여 기존에는 최첨단 모델에서만 가능했던 대규모 워크플로우를 실행할 수 있습니다. 기능 로컬 LLM 지원 : OpenAI 호환 API 엔드포인트에 연결하거나 로컬 LLM 서버 사용 MCP 통합 : RPC 및 SSE 프로토콜 모두에 대한 완전한 Model Conte...

aegis-latent-core

Aegis Latent Core Шлюз управления ИИ и криптографических доказательств Aegis Latent Core фиксирует подписанные, связанные хешами доказательства каждого управляемого вызова ИИ — до того, как ответ достигнет вызывающей стороны — и выдаёт переносное доказательство, которое третья сторона проверяет, ...

CVE-2026-100654 vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids

vLLM before 0.29.0 accepts user-controlled stoptokenids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When mintokens 0, the stop token ids a...

CVE-2026-100647

Versions of vLLM before 0.29.0 are vulnerable to a Denial of Service (DoS) due to an Improper Input Validation flaw in the cache_salt parameter. The application fails to enforce a maximum length on this parameter across multiple API endpoints, including OpenAI-compatible and Anthropic handlers. A...

Insertion of Sensitive Information into Log File

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the OpenAI-compatible transport layer, when a pinned third-party provider session whose resolved model metadata lacks a concrete base...

CVE-2026-100528

OpenClaw npm package 'openclaw' before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a mod...

CVE-2026-100528 OpenClaw before 2026.8.1 Credential Disclosure via Provider Endpoint

OpenClaw npm package 'openclaw' before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a mod...

CVE-2026-100528

The OpenClaw npm package (openclaw ) versions prior to 2026.8.1 are vulnerable to a credential disclosure flaw. When using a third-party provider with an OpenAI-compatible API that lacks a concrete base URL in its metadata, a pinned session following a model configuration hot reload may retain th...

EUVD-2026-87522

OpenClaw npm package 'openclaw' before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a mod...

CVE-2026-100528 OpenClaw before 2026.8.1 Credential Disclosure via Provider Endpoint

OpenClaw npm package 'openclaw' before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a mod...

PT-2026-99165

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description When a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a model configuration hot reload retains...

CVE-2026-100647: Improper Input Validation

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cachesalt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP...

CVE-2026-100528: Exposure of Sensitive Information to an Unauthorized Actor

OpenClaw npm package 'openclaw' before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a mod...

CVE-2026-94626

A flaw was found in vLLM. A remote attacker can exploit a vulnerability in the kvtransferparams function on OpenAI-compatible completion endpoints by supplying an unvalidated tpsize parameter. This allows for unbounded memory allocation, leading to memory exhaustion and a kernel Out-Of-Memory OOM...

CVE-2026-85686

ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...

CVE-2026-85686 ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLs

ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...

CVE-2026-85686 ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLs

ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...

CVE-2026-85686

ms-swift 4.5.2 (ModelScope) contains an unauthenticated SSRF in the swift deploy OpenAI-compatible API. The vulnerable component is vision_utils.py, which fetches multimodal media URLs (image_url , audio_url , video_url ) without URL validation or redirect filtering. An attacker can supply arbitr...

CVE-2026-85686: Server-Side Request Forgery (SSRF)

ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...