CVE-2026-17501

A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull...

CVE-2026-17501

CVE-2026-17501 affects ggml-org llama.cpp within the JSON-Schema-to-GBNF Conversion pipeline, specifically the transform function in common/json-schema-to-grammar.cpp. The issue involves resource allocation during processing, with remote initiation possible per the description, and a fix pull req...

CVE-2026-17501 ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion

A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull...

CVE-2026-17500

A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function visitpattern of the file common/json-schema-to-grammar.cpp. The manipulation results in null pointer dereference. The attack can be launched remotely. The pull request to fix this issue awaits acceptance...

CVE-2026-17500

The CVE concerns ggml-org llama.cpp (d006858/e15efe0) with impact centered on the function _visit_pattern in common/json-schema-to-grammar.cpp. The issue enables a null pointer dereference and can be triggered remotely. A fix is not yet accepted; a pull request to address this issue is awaiting a...

EUVD-2026-49060

A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function visitpattern of the file common/json-schema-to-grammar.cpp. The manipulation results in null pointer dereference. The attack can be launched remotely. The pull request to fix this issue awaits acceptance...

PT-2026-64821

Name of the Vulnerable Software and Affected Versions llama.cpp version e15efe0 Description A flaw exists in the JSON-Schema-to-GBNF Conversion component within the transform function of the common/json-schema-to-grammar.cpp file. This issue allows a remote attacker to trigger an excessive...

PT-2026-64820

A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function visit pattern of the file common/json-schema-to-grammar.cpp. The manipulation results in null pointer dereference. The attack can be launched remotely. The pull request to fix this issue awaits acceptanc...

Linux Distros Unpatched Vulnerability : CVE-2026-17500

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function visitpattern of the file common/json-schema-to-grammar.cpp. The...

Linux Distros Unpatched Vulnerability : CVE-2026-17501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the...

CVE-2026-12512

The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes...

CVE-2026-12512 Quotes Llama < 3.1.6 - Unauthenticated SQL Injection via sc Parameter

The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes...

CVE-2026-12512

CVE-2026-12512 affects the Quotes Llama WordPress plugin prior to 3.1.6. The root cause is improper sanitization/escaping of a user-supplied parameter before it is used in a SQL query, enabling unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the databas...

CVE-2026-12512

The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes...

PYSEC-2026-2606 LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class

A vulnerability in the DocugamiReader class of the run-llama/llamaindex repository, up to but excluding version 0.12.41, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting ...

MAL-2026-10163 Malicious code in llama-tokenizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b22305b1026f27be6d5b78dc19f7db7a05cc9d1818b7ebc7cda0fce92431aa02 This package typosquats llama-tokenizer-js. On require, index.js reconstructs a host and URL path from String.fromCharCode numeric arrays, downloads ...

Malicious code in llama-tokenizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b22305b1026f27be6d5b78dc19f7db7a05cc9d1818b7ebc7cda0fce92431aa02 This package typosquats llama-tokenizer-js. On require, index.js reconstructs a host and URL path from String.fromCharCode numeric arrays, downloads ...

PYSEC-2026-1572 Llama Stack exposes secret in initialization log

Llama Stack aka llama-stack before 0.4.0rc3 does not censor the pgvector password in the initialization log...

PYSEC-2026-1560 llama-index-core vulnerable to Uncontrolled Resource Consumption

The SimpleDirectoryReader component in llamaindex.core version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit numfileslimit is applied after all files in a directory are loaded into memory. Thi...

PYSEC-2026-1556 llama-index has Insecure Temporary File

The llamaindex library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, dat...