GHSA-PH72-CQR5-QPP7 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the scale-out transport path reaches. Summary vLLM's disaggregated scale-out transport splits a multimodal...

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Description A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 C extension lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The...

GHSA-54P9-H82J-F925 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Description A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 C extension lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The...

GHSA-JP82-F5MQ-HWHP Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

Summary deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element count. Pass a plain object with a length property and it hits the array-like TypedArray constructor, allocating that many elements. The offset guard above it can't stop this:...

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

Summary deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element count. Pass a plain object with a length property and it hits the array-like TypedArray constructor, allocating that many elements. The offset guard above it can't stop this:...

GHSA-G2V6-RQMX-R4W6 @vue/server-renderer: XSS via missing CR in attribute-name blacklist

Description @vue/server-renderer was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body -- a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser session that's already...

@vue/server-renderer: XSS via missing CR in attribute-name blacklist

Description @vue/server-renderer was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body -- a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser session that's already...

CVE-2023-43317

CVE-2023-43317 Обычный пользователь может повысить свои привилегии через параметр userPermissionsLIst в компоненте Session Storage, чтобы получить несанкционированный доступ к ресурсам и функциям уровня администратора. Это может привести к несанкционированному доступу к данным, их изменению и...

vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

Summary vm2 3.11.6 this fork's latest release contains an incomplete-fix bypass of the Error.cause host-reference sanitization added in GHSA-m283-3h24-438v commit 7e3faaf. Sandbox code that catches a host-wrapped AggregateError which is revisited within a single handleException traversal...

GHSA-X965-FC75-JPQH vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

Summary vm2 3.11.6 this fork's latest release contains an incomplete-fix bypass of the Error.cause host-reference sanitization added in GHSA-m283-3h24-438v commit 7e3faaf. Sandbox code that catches a host-wrapped AggregateError which is revisited within a single handleException traversal...

CVE-2024-10448

영향받는 버전: BloodBank Management System : 1.0 취약점 정보: 취약점 유형: 사이트 간 요청 위조 CSRF 심각도: 높음 상태: 패치되지 않음 취약한 엔드포인트: 경로: /file/delete.php?bid= 취약점 설명: BloodBank Management System의 혈액 요청 기능 에서 사이트 간 요청 위조CSRF 취약점이 발견되었습니다. 이 결함은 이 경로 /file/delete.php?bid=로 delete 요청을 보낼 때 발생하며, bid 매개변수를 통해 애플리케이션에서 삭제할 레코드...

GHSA-4XHP-XG4W-8PPM Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Summary The ODF backend resolves the xlink:href of a draw:image element as a filesystem path whenever the referenced part is not found inside the document archive. The value comes straight from content.xml, so it is document content, and it is used with no scheme check, no confinement to the...

Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Summary The ODF backend resolves the xlink:href of a draw:image element as a filesystem path whenever the referenced part is not found inside the document archive. The value comes straight from content.xml, so it is document content, and it is used with no scheme check, no confinement to the...

CVE-2026-105751

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

EUVD-2026-92815

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

CVE-2026-105751 Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

CVE-2026-105751

The Docling document processing library (versions 2.107.0 through 2.120.3 ) is vulnerable to an arbitrary local file read in the OpenDocument backend . The issue exists because the _image_ref_from_odf_image function in docling/backend/opendocument_backend.py uses the xlink:href attribute of a dra...

CVE-2026-105751

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

CVE-2026-105751 Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

CVE-2026-105751 Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...