133 matches found
CVE-2026-15971
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPERSERVERPORT is set, enabling code execution on inference requests...
CVE-2026-15971 CVE-2026-15971
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPERSERVERPORT is set, enabling code execution on inference requests...
EUVD-2026-51262
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPERSERVERPORT is set, enabling code execution on inference requests...
CVE-2026-15971
SGLang contains a remote code execution vulnerability (CVE-2026-15971) that triggers when the optional dumper subsystem is enabled. The root cause is a sandbox escape via DUMPER_SERVER_PORT, enabling code execution on inference requests. Multiple sources (NVD, CVE lists, OSV, etc.) consistently d...
CVE-2026-15971 CVE-2026-15971
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPERSERVERPORT is set, enabling code execution on inference requests...
PT-2026-66559
Name of the Vulnerable Software and Affected Versions SGLang affected versions not specified Description An issue exists when the optional dumper subsystem is enabled and the DUMPER SERVER PORT variable is set. This allows for a sandbox escape, which can lead to remote code execution during...
CVE-2026-47730
Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate and Profile::getName into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dum...
CVE-2026-47730
Twig: XSS in Twig\Profiler\Dumper\HtmlDumper allows attacker-controlled template/profile names to inject HTML in profiler output due to unescaped getTemplate()/getName() data. Affects Twig 3.0.0ā3.26.0; fixed in 3.26.0 by escaping these values via htmlspecialchars(). No exploit details provided b...
CVE-2026-47730 Twig: XSS in profiler HtmlDumper via unescaped template and profile names
Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate and Profile::getName into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dum...
CVE-2026-47730 Twig: XSS in profiler HtmlDumper via unescaped template and profile names
Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate and Profile::getName into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dum...
UBUNTU-CVE-2026-59870
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem to perform a linear duplicate-key scan on every insertion, causing On^2 CPU consumption when yaml.load parses a crafted ordered-map...
UBUNTU-CVE-2026-53550
js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size an...
GHSA-2G2G-8P8H-FGWM Twig: XSS in profiler HtmlDumper via unescaped template and profile names
Description Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate and Profile::getName straight into its HTML output without escaping: php protected function formatTemplateProfile $profile, $prefix: string return \sprintf'%sā %s', $prefix, self::$colors'template', $profile-getTemplate; The...
XSS in profiler HtmlDumper via unescaped template and profile names
More info at https://symfony.com/cve-2026-47730...
CVE-2026-4851
GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization. GRID::Machine provides Remote Procedure Calls RPC over SSH for Perl. The client connects to remote hosts to execute code on them. A compromised or malicious remote host can execute arbitrary...
CVE-2026-4851
GRID::Machine (Perl) up to version 0.127 is affected by arbitrary code execution due to unsafe deserialization in read_operation() where $arg is deserialized via eval(); a compromised remote host can inject Perl code in the Dumper-formatted response, executing on the client with every RPC call. T...
CVE-2025-10283
BBOT's gitdumper module could be abused to execute commands through a malicious git repository...
EUVD-2017-1347
Malware in sbrugna...
EUVD-2014-4257
Malware in sbrugna...
SUSE CVE-2025-39764
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: remove refcounting in expectation dumpers Same pattern as previous patch: do not keep the expectation object alive via refcount, only store a cookie value and then use that as the skip hint for dump...