GHSA-Q8GQ-377P-JQ3R vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

Summary An assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode python -O or PYTHONOPTIMIZE=1. Details vLLM uses ...

CVE-2026-8261

The CVE-2026-8261 entry concerns Squirrel up to version 3.2. The vulnerability resides in SQFunctionProto::Load within squirrel/sqobject.cpp, causing a heap-based buffer overflow. Attack is restricted to local execution. Public disclosure of the exploit is noted, and the project was informed via ...