CVE-2026-5497 Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory OOM Denial of Service DoS attack due to unbounded frame count processing in the VideoMediaIO.loadbase64 method. When processing video/jpeg data URLs, the method splits the base64 data string on commas to extract individual JPEG fram...

Europol Seizes First VPN Used by Ransomware Gangs, Arrests Administrator

Europol has seized First VPN, a service used by ransomware gangs, arrested its administrator and gained access to data linked to thousands of users...

Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

Impact Active Storage’s proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability...

[SECURITY] Fedora 42 Update: wireshark-4.6.3-1.fc42

Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless WiFi or Bluetooth networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. It has many powerful...

curl: Directory listing vulnerability is disclosing names and emails, widespread (thousands of records, publicly accessible without auth)

Summary: directory listing vulnerability is disclosing names and emails and so many other sensitive information, that significantly increases the severity because these are considered as PII Personally Identifiable Information. Thousands of records, publicly accessible without auth also can be...

Sift or Get off the PoC: Applying Information Retrieval to Vulnerability Research with SiftRank

Security research is fundamentally a problem of resource constraint and consequent prioritization. There is simply too much attack surface and too little time and energy to spend analyzing it all. The most effective security researchers are often those who are most skilled at intuitively deciding...

EulerOS 2.0 SP9 : systemd (EulerOS-SA-2024-1974)

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The Closest Encloser Proof aspect of the DNS protocol in RFC 5155 when RFC 9276 guidance is skipped allows remote attackers to cause a denial of...

nss: vulnerable to Minerva side-channel information leak

The Network Security Services NSS package contains a vulnerability that exposes a side-channel information leak. This weakness enables a local attacker to capture several thousand usages of a signature, allowing them to utilize this information to recover portions of an ECDSA private key...

Malicious code in oculoushide (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9b7403cc73bb98e45396c93de766686608f4d7f80a03e6e8af73d244de0c7fe1 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in tpcraftcraftencode (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d51287043143cc2b77dac9f3dac8fe7c54c6e797cee2425b1a581c4565357235 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in libpongcvvm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 81660c08bc5b6d02626c861b078200dbc97f4f3eef60a500e32757b2c24a39fc EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in esqcvvermask (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ff37efac8ff00c6c0fcd45c76f69f5baf4d79c1a6d2beef9826e2569e30c4073 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in selfinfoponged (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 04ac261aa352ac2d7834c9f0783bec5a7f6936cd81ac4ffa923993351d85657d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in esqlibcpuosint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8760b4961c437a72b606af72f5988d2329ee17f72f90e126cb64f64c5f6e9212 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in selfcvinfoad (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 934ef50eb7830e1355e375cbb3e865e916602091e5eb92946e6980facdcaa45f EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in esqsplitpushpush (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 2fd3cf23b26151d092b1a0e2fb62c51e67796723f3e2bb590f5dee0e4dd6d1c9 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in liburlcraftgrand (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx eb06ad8b5fee491f5b9567ad8937fcbe7c55fb3c421a9e259fdb41bf852da623 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in selfinfopaypalad (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9c9adb7783ac0804db814cd23b6dc9def585e3f6faabb2f72382a596e7b94edc EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in libcontrolhttpstr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ec54d33b4978cf8aeb5ed3e67dbc5b622f0765d0812587bb826940a7ea1aa67f EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in esqcpupipkill (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 0ad033fc63cd19958fd0a2227af894a9ee647a59260b564cc71cee1c7f9e1000 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...