2039446 matches found
CVE-2026-115911 vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by...
CVE-2026-115911 vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by...
CVE-2026-116395 WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through 1.2.0...
CVE-2026-116395 WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through 1.2.0...
CVE-2026-115598 WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11...
CVE-2026-115598 WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11...
CVE-2026-114710 WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7...
CVE-2026-114710 WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7...
CVE-2026-115597 WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11...
CVE-2026-115597 WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11...
CVE-2026-116388 WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability
Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...
CVE-2026-116388 WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability
Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...
CVE-2026-116396 WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TMS Amelia ameliabooking allows Stored XSS.This issue affects Amelia: from n/a through 2.4.12...
CVE-2026-116396 WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TMS Amelia ameliabooking allows Stored XSS.This issue affects Amelia: from n/a through 2.4.12...
CVE-2026-115909 zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::withcapacity for a symbolic link target using the attacker-controlled ZIP64 uncompressedsize before reading entry data. A small archive can...
CVE-2026-115909 zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::withcapacity for a symbolic link target using the attacker-controlled ZIP64 uncompressedsize before reading entry data. A small archive can...
CVE-2026-116403 WordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerability
Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a through 3.7.1...
CVE-2026-116403 WordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerability
Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a through 3.7.1...
CVE-2026-115908 zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extractunwrappedrootdir use safepreparepath in src/read/zipfile.rs and simplifiedcomponents in src/path.rs to validate symbolic link targets with a lexical...
CVE-2026-115908 zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extractunwrappedrootdir use safepreparepath in src/read/zipfile.rs and simplifiedcomponents in src/path.rs to validate symbolic link targets with a lexical...