346 matches found
CVE-2026-7141
A flaw was found in vllm. A remote attacker can exploit a vulnerability in the hasmambalayers function within the KV Block Handler component. By performing a specific manipulation, an uninitialized resource can be triggered, potentially leading to information disclosure or denial of service. The...
vLLM makes Use of Uninitialized Resource
A vulnerability was found in vLLM up to 0.19.0. The affected element is the function hasmambalayers of the file vllm/v1/kvcacheinterface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource. It is possible to initiate the attack remotely. The attack is...
Use of Uninitialized Resource
Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Use of Uninitialized Resource via the hasmambalayers function in the KV Block Handler. An attacker can cause unintended behavior by leaking data...
PYSEC-2026-2306
A vulnerability was found in vllm up to 0.19.0. The affected element is the function hasmambalayers of the file vllm/v1/kvcacheinterface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource. It is possible to initiate the attack remotely. The attack is...
PYSEC-2026-2306
A vulnerability was found in vllm up to 0.19.0. The affected element is the function hasmambalayers of the file vllm/v1/kvcacheinterface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource. It is possible to initiate the attack remotely. The attack is...
CVE-2026-7141
CVE-2026-7141 affects vllm up to 0.19.0, specifically the KV Block Handler’s has_mamba_layers function in vllm/v1/kv_cache_interface.py. A manipulation can trigger an uninitialized resource, with remote initiation possible. The issue is described as high complexity and difficult exploitability, w...
MINI-9XHC-F675-R9J7
Bulletin has no description...
MINI-947F-P9M4-7HXC
Bulletin has no description...
CVE-2026-6597
langflow-ai (Flow Using API) up to version 1.8.3 is affected by CVE-2026-6597. The vulnerability resides in the code path src/backend/base/langflow/api/utils/core.py, specifically the remove_api_keys/has_api_terms functions, which enables unprotected storage of credentials. The issue can be explo...
RHSA-2026:8541 Red Hat Security Advisory: nghttp2 security update
Bulletin has no description...
MINI-RP3C-MJ84-C4PG
Bulletin has no description...
MINI-7HGP-VVV4-H87H
Bulletin has no description...
File Browser has an access rule bypass via HasPrefix without trailing separator in path matching
Hi, The Matches function in rules/rules.go uses strings.HasPrefix without a trailing directory separator when matching paths against access rules. A rule for /uploads also matches /uploadsbackup/, granting or denying access to unintended directories. Verified against v2.62.2 commit 860c19d. Detai...
RHSA-2026:4418 Red Hat Security Advisory: OpenShift Container Platform 4.15.62 packages and security update
Bulletin has no description...
MINI-PXFH-VWH4-7RFG
Bulletin has no description...
Hacked App Part of US/Israeli Propaganda Campaign Against Iran
Wired has the story: Shortly after the first set of explosions, Iranians received bursts of notifications on their phones. They came not from the government advising caution, but from an apparently hacked prayer-timing app called BadeSaba Calendar that has been downloaded more than 5 million time...
lxml_html_clean 安全漏洞
lxmlhtmlclean is a separate project derived from lxml.HTML.clean, open sourced by the Fedora Python SIG. Versions of lxmlhtmlclean prior to 0.4.4 contained security vulnerabilities. These vulnerabilities stemmed from the hassneakyjavascript method, which strips backslashes before checking for...
MINI-P3PQ-5XGV-P6MC
Bulletin has no description...