CVE-2026-100649

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

Path Traversal

WWBN AVideo is vulnerable to Path Traversal. The vulnerability is due to improper validation of attacker-controlled URLs in aVideoEncoderReceiveImage.json.php, where crafted same-origin /videos/... requests bypass path restrictions and expose server-local files, allowing authenticated attackers t...