17029 matches found
CVE-2025-46570 vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel
vLLM is an inference and serving engine for large language models LLMs. Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT Time to First Token. These timing differences...
CVE-2025-5334
The Devolutions Remote Desktop Manager application contains a vulnerability in the user vaults component that allows authenticated users to gain unauthorized access to private personal information. The root cause is that entries may be unintentionally moved from user vaults to shared vaults when ...
Unauthorized Access
com.ritense.valtimo:object-management and com.ritense.valtimo:objecten-api is vulnerable to Unauthorized Access. The vulnerability is due to improper access control and the lack of enforcement of object-management configurations, allowing unauthorized users to list, view, edit, create, or delete...
CVE-2025-37993 can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe
In the Linux kernel, the following vulnerability has been resolved: can: mcan: mcanclassallocatedev: initialize spin lock on device probe The spin lock txhandlingspinlock in struct mcanclassdev is not being initialized. This leads the following spinlock bad magic complaint from the kernel, eg. wh...
MINI-JV9G-4RCV-W7J7
Bulletin has no description...
PT-2025-23798
Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect Cloud Agent Linux, macOS, Windows versions before build 40077 Description The issue is related to a denial of service caused by improper handling of malformed input. Recommendations For Acronis Cyber Protect Cloud Agent...
PT-2025-23220
Name of the Vulnerable Software and Affected Versions Fabio versions prior to 1.6.6 Description Fabio is an HTTPS and TCP router for deploying applications managed by consul. A vulnerability in how it processes hop-by-hop headers allows clients to remove X-Forwarded headers except X-Forwarded-For...
MAL-2025-4561 Malicious code in halodoc (npm)
The package communicates with a domain associated with malicious activity...
BIT-GITLAB-2024-7803 Allocation of Resources Without Limits or Throttling in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A Discord webhook integration may cause DoS...
BIT-VARNISH-2025-47905
Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries...
Out-of-Bounds Read
libassimp.so is vulnerable to Out-of-bounds Read. The vulnerability is due to improper input validation due to insufficient bounds checking in the LWOImporter::CountVertsAndFacesLWO2 function, which may allow local attackers to read unintended memory content...
BELL-CVE-2025-5278
Bulletin has no description...
BELL-CVE-2025-5244
Bulletin has no description...
PT-2025-23224 · Vllm · Vllm
Name of the Vulnerable Software and Affected Versions: vLLM versions 0.6.4 through 0.9.0 Description: The issue is a Regular Expression Denial of Service ReDoS vulnerability in the file vllm/entrypoints/openai/tool parsers/pythonic tool parser.py. The root cause is the use of a highly complex and...
CVE-2025-30087
Best Practical RT Request Tracker 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL...
PT-2025-23097 · Dell · Dell Powerstore
Name of the Vulnerable Software and Affected Versions: Dell PowerStore version 4.0.0.0 Description: The issue concerns the use of hard-coded credentials in the PowerStore image file. A low-privileged attacker with remote access and knowledge of these credentials could exploit this to gain...
PT-2025-23135 · Vllm · Vllm
Name of the Vulnerable Software and Affected Versions: vLLM versions prior to 0.9.0 Description: The issue arises from the prefix caching mechanism in vLLM, which may expose the system to a timing side-channel attack. When a new prompt is processed, if the PageAttention mechanism finds a matching...
PT-2025-23106
Name of the Vulnerable Software and Affected Versions Kea versions 2.4.0 through 2.4.1 Kea versions 2.6.0 through 2.6.2 Kea versions 2.7.0 through 2.7.8 Description In some cases, Kea log files or lease files may be world-readable. Recommendations For Kea versions 2.4.0 through 2.4.1, update to a...
