CVE-2024-41301-Bookea-tu-Mesa-is-vulnerable-to-Stored-Cross-Site-Scripting

CVE-2024-41301 - Bookea-tu-Mesa-is-vulnerable-to-Stored-Cross-Site-Scripting Bookea-tu-Mesa is susceptible to a Stored Cross-Site Scripting XSS vulnerability. This flaw allows attackers to inject malicious scripts that execute within the context of a user's session. Steps to Reproduce: 1. Go to...

CVE-2024-41302-Bookea-tu-Mesa-is-vulnerable-to-SQL-Injection

CVE-2024-41302-Bookea-tu-Mesa-is-vulnerable-to-SQL-Injection- Bookea-tu-Mesa is susceptible to a SQL Injection SQLi vulnerability. This flaw allows attackers to inject malicious SQL commands that can manipulate the database, potentially compromising the application's data integrity and security...

gha-lab-ca4fa82ac5

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of mesa/mesa at commit...

Astra Linux – Vulnerability in Mesa

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of data to be allocated depends on an untrusted party, and this data is then used for the alloca function...

ROOT-OS-DEBIAN-11-CVE-2026-40393 CVE-2026-40393 in mesa - Patched by Root

Root has patched CVE-2026-40393 in the mesa package for Root:Debian:11. Multiple fixed versions available...

aleph-alpha-inference (1.0.0), evoke-vllm (>=0.1.0, <=0.1.1) +6 more potentially affected by CVE-2026-105758 via vllm (>=0.24.0, <=0.29.0)

vllm PYPI version =0.24.0, =0.1.0, =2.9.0, =2.3.0, =0.1.10, =0.1.0, =0.1.4 Source cves: CVE-2026-105758 Source advisory: MEND:CVE-2026-105758...

evoke-vllm (>=0.1.0, <=0.1.1), lazyllm-verl (0.3.2.dev1) +6 more potentially affected by CVE-2026-100653 via vllm (>=0.22.1, <=0.27.1)

vllm PYPI version =0.22.1, =0.1.0, =2.8.0, =2.2.2, =0.1.10, =0.1.0, =0.1.3 Source cves: CVE-2026-100653 Source advisory: SNYK:PYTHON-VLLM-20158365...

lazyllm-verl (0.3.2.dev1), londonaicentre-mesa-local (>=2.8.0, <=2.8.1) +1 more potentially affected by CVE-2026-100652 via vllm (>=0.22.0, <=0.23.0)

vllm PYPI version =0.22.0, =2.8.0, =2.1.3, =2.2.4 Source cves: CVE-2026-100652 Source advisory: SNYK:PYTHON-VLLM-20158366...

lazyllm-verl (0.3.2.dev1), londonaicentre-mesa-local (>=2.8.0, <=2.8.1) +1 more potentially affected by CVE-2026-100652 via vllm (>=0.22.0, <=0.23.0)

vllm PYPI version =0.22.0, =2.8.0, =2.1.3, =2.2.4 Source cves: CVE-2026-100652 Source advisory: OSV:PYSEC-2026-4185...

lazyllm-verl (0.3.2.dev1), londonaicentre-mesa-local (>=2.8.0, <=2.8.1) +1 more potentially affected by CVE-2026-100652 via vllm (>=0.22.0, <=0.23.0)

vllm PYPI version =0.22.0, =2.8.0, =2.1.3, =2.2.4 Source cves: CVE-2026-100652 Source advisory: MEND:CVE-2026-100652...

Linux Distros Unpatched Vulnerability : CVE-2026-97620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches emitrendercacheflush sets PIPECONTROL0HDCPIPELINEFLUSH to flush the L2/HDC data cache before...

CVE-2026-98143

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Don't read the U65 rounding mode as a storage mode Bits 15:14 of NPUSETIFM,OFMPRECISION select the activation storage mode on U85 only. On U65 the same field holds the rounding mode, and the command stream parser h...

caption-flow (>=0.5.0, <=0.5.1), evoke-vllm (>=0.1.0, <=0.1.1) +8 more potentially affected by CVE-2026-93840 via vllm (>=0.19.0, <=0.28.0)

vllm PYPI version =0.19.0, =0.5.0, =0.1.0, =2.5.3, =0.1.1.4, =2.1.2, =0.1.10, =0.1.0, =0.1.4 Source cves: CVE-2026-93840 Source advisory: MEND:CVE-2026-93840...

EulerOS Virtualization 2.11.1 : mesa (EulerOS-SA-2026-3440)

According to the versions of the mesa packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated dat...

EulerOS Virtualization 2.11.0 : mesa (EulerOS-SA-2026-3527)

According to the versions of the mesa packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated dat...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Avoid NULL pointer dereferencing in v3djobupdatestats The following kernel error was recently reported by Mesa CI: 800.139824 Unable to handle NULL pointer dereferencing at virtual address 0000000000000588 800.148619...

Astra Linux – Vulnerability in Firefox and Thunderbird

The WebGL DrawElementsInstanced method was vulnerable to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR 115.6, Thunderbird 115.6, and Firefox 121...

evoke-vllm (>=0.1.0, <=0.1.1), lazyllm-verl (0.3.2.dev1) +3 more potentially affected by CVE-2025-62164 +1 more via vllm (>=0.21.0, <=0.25.1)

vllm PYPI version =0.21.0, =0.1.0, =2.8.0, =2.1.2, =0.1.10, =0.2.2 Source cves: CVE-2025-62164, CVE-2026-73557 Source advisory: OSV:PYSEC-2026-3938...

evoke-vllm (>=0.1.0, <=0.1.1), lazyllm-verl (0.3.2.dev1) +3 more potentially affected by CVE-2025-62164 +1 more via vllm (>=0.21.0, <=0.25.1)

vllm PYPI version =0.21.0, =0.1.0, =2.8.0, =2.1.2, =0.1.10, =0.2.2 Source cves: CVE-2025-62164, CVE-2026-73557 Source advisory: GHSA-PR7F-P5MW-FC87...

evoke-vllm (>=0.1.0, <=0.1.1), lazyllm-verl (0.3.2.dev1) +3 more potentially affected by CVE-2026-73557 via vllm (>=0.21.0, <=0.25.1)

vllm PYPI version =0.21.0, =0.1.0, =2.8.0, =2.1.2, =0.1.10, =0.2.2 Source cves: CVE-2026-73557 Source advisory: OSV:GHSA-PR7F-P5MW-FC87...