nginx

CVE-2017-7529 唐胜表@portfolio10 摘要 本实验重现了Nginx服务器在处理Range请求过程中发生的缓存漏洞CVE-2017-7529，并展示漏洞的实际行为 漏洞：由于Nginx对Range头处理错误，可能导致缓存数据暴露 影响：服务器缓存文件中的敏感数据泄露 环境配置与运行 操作系统：Windows 10 Docker, Python 1. 在特定目录下创建文件夹 2. 创建Dockerfile、poc.py、docker-compose.yml文件 3. 运行'docker compose up -d' 4...

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the scale-out transport path reaches. Summary vLLM's disaggregated scale-out transport splits a multimodal...

GHSA-PH72-CQR5-QPP7 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the scale-out transport path reaches. Summary vLLM's disaggregated scale-out transport splits a multimodal...

EUVD-2026-92845

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on /score and /rerank...

PYSEC-2026-4198

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's querykey value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can...

CVE-2026-105755

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's querykey value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can...

CVE-2026-105756

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cachesalt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the...

CVE-2026-105753

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if...

CVE-2026-105755 vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's querykey value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can...

CVE-2026-105754

The vLLM inference and serving engine (prior to version 0.30.0 ) contains a vulnerability in the /inference/v1/generate endpoint within the disaggregated scale-out path. The root cause is that the system trusts caller-supplied features—specifically in the features.kwargs_data , features.mm_hashes...

CVE-2026-105754 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargsdata field, cache identifiers in the features.mmhashes field, ranges in the...

CVE-2026-105753

The vLLM inference and serving engine is vulnerable to a shared-service availability failure in versions prior to 0.28.0 . The root cause is a desynchronization in the mirrored multimodal LRU cache ; if a request is rejected during multimodal rendering, the frontend sender cache commits a media h...

CVE-2026-105752 vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cachesalt value, placing the continuation prefix in the global unsalted cache...

CVE-2026-105752

The vLLM inference and serving engine is vulnerable in versions prior to 0.30.0 due to a flaw in how Harmony tool continuations are handled via POST /v1/responses requests. The application fails to preserve the cache_salt value when rebuilding the next-turn engine input, causing the continuation ...

CVE-2026-105752 vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cachesalt value, placing the continuation prefix in the global unsalted cache...

CVE-2026-105752 vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cachesalt value, placing the continuation prefix in the global unsalted cache...

DIRTYFAIL

DIRTYFAIL 针对 Copy Fail 和 Dirty Frag Linux 页缓存写入漏洞家族的 统一检测器与 PoC 框架。 ██████╗ ██╗██████╗ ████████╗██╗ ██╗███████╗ █████╗ ██╗██╗ ██╔══██╗██║██╔══██╗╚══██╔══╝╚██╗ ██╔╝██╔════╝██╔══██╗██║██║ ██║ ██║██║██████╔╝ ██║ ╚████╔╝ █████╗ ███████║██║██║ ██║ ██║██║██╔══██╗ ██║ ╚██╔╝ ██╔══╝ ██╔══██║██║██║...

CVE-2026-31635

🩸 CVE-2026-31635 – DirtyDecrypt Linux 内核本地权限提升（通过 RXGK 页面缓存损坏） "DirtyDecrypt" — 2026年 "Dirty" 系列漏洞利用之一 📖 概述 DirtyDecrypt （CVE-2026-31635）是 Linux 内核 rxrpc 子系统（特别是 rxgk 组件）中的一个本地权限提升 漏洞。 它滥用了 AES-CBC 解密过程中缺失的写时复制（COW）检查 ，允许非特权用户损坏页面缓存并实现任意文件写入 ，从而获得 root 权限。 ✨ 功能特性 ✅ 代码清晰、注释完善的 C 语言实现 ✅ 支持用户 + 网络命名...

copy-fail-mcp

Copy Fail MCP 📖 安装指南 — 快速上手、手动安装和故障排除 CVE-2026-31431 — 有史以来最严重的 Linux 漏洞。现在可通过 MCP 控制。 732 字节的 Python。无需编译。无竞态条件。无需按发行版区分的偏移量。 一次执行，即可在 2017 年以来构建的所有 Linux 内核上通用提权至 root。 该工具是一个 MCP 服务器 + Web 仪表板，用于测试任何可达的 Linux 系统是否存在此漏洞。它的诞生是因为原始 PoC 已经非常易于使用——这只是额外增加了界面、网络扫描和主机群跟踪功能。 警告： 这是一个真实的内核...

CVE-2026-31431---Copy-Fail-PoC

描述 本仓库包含对 Linux 内核中 CVE-2026-31431（Copy Fail）的分析。它通过页缓存操作实现本地权限提升（LPE）。 法律声明 本项目仅用于教育和测试目的。任何未经授权的使用均由用户自行承担全部责任。 用法与资源 用法： curl -O URL/exploit.py python3 exploit.py id 参考 Linux 内核 Copy Fail（CVE-2026-3143） | Copy.fail...