CVE-2026-109228

SGLang versions through 0.5.21 are vulnerable to a resource budget bypass in the GLM-V video processing logic. By supplying arbitrary values for fps, max_frames, max_tokens_per_frame, and max_image_tokens within the video_url object, a remote attacker can force glm4v.py to decode every frame of a...

EUVD-2026-97434

SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, maxframes, maxtokensperframe and maximagetokens in the videourl object. Attackers can set these values arbitrarily high so glm4v.py decode...

PT-2026-106272

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.30.0 Description A partial denial of service issue exists in the OpenAI-compatible chat endpoint. A remote caller can provide large values for the fps and max frames variables within the media io kwargs field while...

dapla-team-cli (>=0.2.0, <=0.2.2), dapla-toolbelt-pseudo (>=0.1.0, <=0.4.0) +15 more potentially affected by CVE-2026-54338 via jupyterhub (4.1.6)

jupyterhub PYPI version 4.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - dapla-team-cli =0.2.0, =0.1.0, =0.2.0, =1.0.0, =0.5.0, =0.11.0, =0.2.0, =1.0.2, =0.1.0, =1.1.9, =0.5.0, =0.10.0 - ssb-datadoc 0.1.4 and more...

fps-jupyterlab-git (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-54527 via jupyterlab-git-core (0.53.0)

jupyterlab-git-core PYPI version 0.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab-git-core and may be impacted: - fps-jupyterlab-git =0.3.0, =0.3.1 Source cves: CVE-2026-54527 Source advisory: OSV:PYSEC-2026-2541...

fps-jupyterlab-git (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-54527 via jupyterlab-git-core (0.53.0)

jupyterlab-git-core PYPI version 0.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab-git-core and may be impacted: - fps-jupyterlab-git =0.3.0, =0.3.1 Source cves: CVE-2026-54527 Source advisory: MEND:CVE-2026-54527...

defi-common (>=0.1.5, <=0.1.96), fps-auth (>=0.0.38, <=0.1.4) +1 more potentially affected by CVE-2025-68481 via fastapi-users (10.4.2)

fastapi-users PYPI version 10.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - defi-common =0.1.5, =0.0.38, =1.3.0a1, =1.3.5 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

fief-server (>=0.24.8, <=0.25.3), fps-auth (>=0.1.5, <=0.1.10) +1 more potentially affected by CVE-2025-68481 via fastapi-users (11.0.0)

fastapi-users PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.24.8, =0.1.5, =0.8.0, =0.9.0 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

fastapi-toolkit-shawn587 (>=0.2.1.3, <=0.2.2.0), fps-auth (>=0.2.0, <=0.4.2) +2 more potentially affected by CVE-2025-68481 via fastapi-users (12.1.3)

fastapi-users PYPI version 12.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-toolkit-shawn587 =0.2.1.3, =0.2.0, =1.4.0a9, =0.4.1, =0.5.1 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

fastapi-users-with-username (13.0.0.post1), fps-auth (>=0.5.0, <=0.7.1) +1 more potentially affected by CVE-2025-68481 via fastapi-users (13.0.0)

fastapi-users PYPI version 13.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-users-with-username 13.0.0.post1 - fps-auth =0.5.0, =0.7.1 - guardianhub-core 0.1.0 Source cves: CVE-2025-68481 Source...

fps-jupyterlab-git (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-54527 via jupyterlab-git-core (0.53.0)

jupyterlab-git-core PYPI version 0.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab-git-core and may be impacted: - fps-jupyterlab-git =0.3.0, =0.3.1 Source cves: CVE-2026-54527 Source advisory: GHSA-F962-V9HR-PFG5...

fps-jupyterlab-git (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-54527 via jupyterlab-git-core (0.53.0)

jupyterlab-git-core PYPI version 0.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab-git-core and may be impacted: - fps-jupyterlab-git =0.3.0, =0.3.1 Source cves: CVE-2026-54527 Source advisory: OSV:GHSA-F962-V9HR-PFG5...

CVE-2026-7739

A weakness has been identified in justdan96 tsMuxer up to 2.7.0. This vulnerability affects the function HevcVpsUnit::setFPS of the file /AFLplusplus/tsMuxerprev/tsMuxer/hevc.cpp. This manipulation of the argument trackid causes denial of service. The attack requires local access. The exploit has...

CVE-2026-7740 justdan96 tsMuxer vvc.cpp setFPS denial of service

A security vulnerability has been detected in justdan96 tsMuxer up to 2.7.0. This issue affects the function VvcVpsUnit::setFPS of the file tsMuxer/vvc.cpp. Such manipulation of the argument trackid leads to denial of service. An attack has to be approached locally. The exploit has been disclosed...

tsMuxer security vulnerability

tsMuxer is a transport stream multiplexer developed by Dan’s individual developer, used for re-mixing/reusing basic streams. Versions of tsMuxer 2.7.0 and earlier contain security vulnerabilities. These vulnerabilities stem from the function HevcVpsUnit::setFPS in the...

Malicious Package

Overview fps-logger is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malware in fps-logger

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in fps-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfcfad29caf018b810db804d52bcc51a3c7a58d192a3b0786578cb7d6fdc59a7 The package fps-logger was found to contain malicious code. Source: ghsa-malware 8103cf4a79c0e573f235decb21067a2c997a8a7a342f6e24419f1cbb4ee4721f Any...

MAL-2026-1199 Malicious code in fps-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfcfad29caf018b810db804d52bcc51a3c7a58d192a3b0786578cb7d6fdc59a7 The package fps-logger was found to contain malicious code. Source: ghsa-malware 8103cf4a79c0e573f235decb21067a2c997a8a7a342f6e24419f1cbb4ee4721f Any...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992248)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992248 advisory. In the Linux kernel, the following vulnerability has been resolved: mfd: max77620: Fix refcount leak in max77620initialisefps ofgetchildbyname returns a node pointer...