SUSE CVE-2026-92972

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...

CVE-2026-92972 SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...

PT-2026-94337

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.20 Description When operating in prefill/decode disaggregation mode, the prefill bootstrap service exposes an unauthenticated PUT '/route' endpoint. This allows an attacker to poison the KV transfer routing table b...

h5-vcav-bootstrap-service Local File Read XSS

The vulnerability of the h5-vcav-bootstrap-service plugin in the virtualization infrastructure management software is related to errors in processing relative pathnames to directories. Exploiting this vulnerability allows a malicious actor to read local files on the server where the vulnerable...

PT-2021-5175

Name of the Vulnerable Software and Affected Versions VMware vCenter Server affected versions not specified Description The issue is related to errors in processing relative directory paths in the h5-vcav-bootstrap-service plugin of VMware vCenter Server. This can be exploited by a remote attacke...

CVE-2010-1571: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the bootstrap service in Cisco Unified Contact Center Express UCCX 7.0 before 7.01SR4 and 7.02, unspecified 6.0 versions, and 5.0 before 5.02SR3 allows remote attackers to read arbitrary files via a crafted bootstrap message to TCP port 6295...