ligolo-mp

Ligolo-MP：像VPN一样进行内网穿透，现在还能和朋友一起！ Ligolo-MP 是 Ligolo-ng 的进阶版本，采用客户端-服务器架构，使渗透测试人员能够通过多个并发隧道协同工作。它会自动管理所有 TUN 设备，同时提供清晰的图形界面来追踪一切。 功能特性 多人协作 自动 TUN 管理 自动恢复路由 无限并发中继 支持 SOCKS 和 HTTP 代理（包括 SSPI/SPNEGO 认证） 跨平台代理，兼容 Linux/FreeBSD/MacOS/Windows 7+ 路由至目标机器的环回地址（无需再端口转发） 监听器作为独立重定向器 动态 mTLS...

EUVD-2026-92846

vLLM: Loose cachesalt validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream ValueError denial of service...

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the loose cachesalt validator and unguarded scheduling-path lookup reach. Summary vLLM's OpenAI-compatible...

CVE-2026-105756

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cachesalt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the...

CVE-2026-105756 vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cachesalt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the...

CVE-2026-105756 vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cachesalt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the...

CVE-2026-105756

Prior to version 0.30.0 , the vLLM inference and serving engine is vulnerable to a denial of service via an uncaught ValueError . The root cause is improper input validation of the cache_salt value in OpenAI-compatible request models. On deployments using the LMCache-MP connector, providing a sal...

sccm_sql_backdoor

sccmsqlbackdoor Una herramienta de prueba de concepto que implanta un backdoor controlado en un procedimiento almacenado de Management Point, permitiendo la ejecución indirecta de SQL a través de un servicio HTTP legítimo de MP. Instalación Puedes instalarlo clonando el repositorio e instalando l...

PT-2026-106266

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.30.0 Description vLLM is an inference and serving engine for large language models. OpenAI-compatible request models accept a cache salt value without enforcing the character and length restrictions required by the...

mp-flipper

MicroPython Flipper Zero Te permite usar el poder de Python de forma nativa en tu Flipper Zero. La aplicación está disponible en el Flipper Lab oficial. Para más detalles sobre cómo programar tu Flipper con Python, consulta la documentación en GitHub Pages. Descargo de responsabilidad Esta versió...

CVE-2024-48197

CVE-2024-48197 AudioCodes MP-202b 中的反射型 XSS 描述 AudioCodes MP-202b v.4.4.3 中存在跨站脚本攻击漏洞，允许远程攻击者通过 Web 界面的登录页面提升权限。 附加信息 无 漏洞类型 反射型跨站脚本攻击 XSS 产品供应商 AudioCodes 受影响产品代码库 MP-202b - 4.4.3 受影响组件 设备 Web 界面的登录页面 攻击类型 远程 权限提升影响 是 攻击向量 必须诱使用户通过特制的 URL 登录应用程序。该特制 URL 随后可用于捕获登录凭据。 发现者 Gareth C - AnchorSec...

PT-2026-90270

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Multipath TCP MPTCP implementation where the mptcp token join cookie init state function fails to restore the local id when rebuilding a request socket for an MP...

PT-2026-96549

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local id in syncookie MP JOIN reconstruction mptcp token join cookie init state restores remote nonce, local nonce, backup, join id, token and msk from the saved cookie entry when rebuilding the request...

Improper Input Validation

Overview pocketmine/pocketmine-mp is a highly customisable, open source server software for Minecraft: Bedrock Edition written in PHP Affected versions of this package are vulnerable to Improper Input Validation via the LoginPacket process. An attacker can cause the server to crash by sending...

Improper Enforcement of a Single, Unique Action

Overview pocketmine/pocketmine-mp is a highly customisable, open source server software for Minecraft: Bedrock Edition written in PHP Affected versions of this package are vulnerable to Improper Enforcement of a Single, Unique Action in the handling of ResourcePackClientResponsePacket packets wit...

Incomplete List of Disallowed Inputs

Overview pocketmine/pocketmine-mp is a highly customisable, open source server software for Minecraft: Bedrock Edition written in PHP Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via improper validation of the Certificate field during offline login...

CVE-2026-86203

PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for...

CVE-2026-86202

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste...

CVE-2026-86200

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown...

CVE-2026-86201

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object...