CVE-2026-116181

vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stoptokenids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or writ...

CVE-2026-116174

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.tokenids values to trigger a fatal embedding...

CVE-2026-116172

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass maxlogprobs limits via CandidateTokens.topn. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping topn values t...

EUVD-2026-109433

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass maxlogprobs limits via CandidateTokens.topn. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping topn values t...

PT-2026-123013

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max logprobs limits via CandidateTokens.top n. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping top n value...

NetScaler ADC and Gateway 14.1-73.36 Remote Code Execution

NetScaler ADC and Gateway versions before 14.1-73.37 and 13.1-64.23 contain an unauthenticated remote code execution vulnerability due to improper input validation...

PT-2026-123022

vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop token ids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or...

CVE-2026-116013

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parsesection and decodename that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raisi...

DEBIAN-CVE-2026-116013

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parsesection and decodename that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raisi...

CVE-2026-116013

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parsesection and decodename that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raisi...

EUVD-2026-109271

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parsesection and decodename that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raisi...

CVE-2026-116013

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parsesection and decodename that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raisi...

CVE-2026-114697

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1...

CVE-2026-114694

The Pixelite Events Manager WordPress plugin (versions through 7.4.8 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability due to the Improper Neutralization of Input During Web Page Generation . This flaw allows an attacker to inject malicious scripts into web pages. No specifi...

CVE-2026-114695 WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infomaniak: from n/a through 1.5.14...

CVE-2026-114694 WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8...

CVE-2026-114697

The WordPress QA Analytics plugin (qa-heatmap-analytics) is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 5.3.0.1 . The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to store malicious scripts...

CVE-2026-114697 WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1...

CVE-2026-114697 WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1...

CVE-2026-112869

The Noah Hearle We’re Open! WordPress plugin is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability (CWE-79) in versions n/a through 2.6 . The flaw stems from the Improper Neutralization of Input During Web Page Generation , which could allow an attacker to execute scripts in a use...