324962 matches found
MAL-2026-13934 Malicious code in ai-analyzer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8949a02ffb1efc0779485ac4daedb4c0c1810f0a1a87dc5ba60c6f72c6e1cf22 The preinstall lifecycle script in preinstall.js issues an HTTPS request whose hostname is constructed as os.hostname prefixed to a hardcoded...
CVE-2026-73558
The CVE concerns vLLM, an inference/serving engine for LLMs. Before version 0.27.0, an integer overflow in blockIdx.x * 2 * d within activation_kernels.cu enables act_and_mul_kernel to consume input from another user within the same inference batch, causing cross-user data leakage of partial or c...
EUVD-2026-58066
vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x 2 d in activationkernels.cu can cause actandmulkernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or...
CVE-2026-73558 vLLM: Cross-User Data Leak Vulnerability
vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x 2 d in activationkernels.cu can cause actandmulkernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or...
CVE-2026-73558 vLLM: Cross-User Data Leak Vulnerability
vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x 2 d in activationkernels.cu can cause actandmulkernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or...
jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...
org.apache.camel/camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data
A flaw was found in the camel-vertx-http component of Apache Camel. This vulnerability, a Deserialization of Untrusted Data, could allow a remote attacker to execute arbitrary code. By controlling the backend server or acting as a man-in-the-middle, an attacker could send a specially crafted...
camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure
A flaw was found in the Apache Camel Vertx Websocket component. This vulnerability allows an unauthenticated remote attacker to inject malicious query parameters into a WebSocket connection. This can lead to Server-Side Request Forgery SSRF, where the server is coerced into making requests to...
io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header
A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...
Denial Of Service (DoS)
Spring Data Commons is vulnerable to Denial Of Service. The vulnerability is due to attacker-supplied strings being permanently retained as internal property-lookup cache keys, allowing repeated requests to exhaust application heap memory...
CVE-2026-73188
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-13610...
CVE-2026-73344
Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
CVE-2026-66463
Unauthenticated Sensitive Data Exposure in iCARRY = 2.9 versions...
CVE-2026-66462
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...
CVE-2026-66432
Subscriber Sensitive Data Exposure in WPJAM Basic = 7.0.2.1 versions...
CVE-2026-66443
Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...
CVE-2026-66444
Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...
CVE-2026-28174
Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...
CVE-2025-62318
HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page JavaScript hijacking under certain conditions...