CVE-2026-93711

Dancer2 for Perl versions before 2.2.0 contain a header injection vulnerability in the headers_to_array routine. The routine strips CR and LF from header values but not from header names , allowing an attacker-controlled name to carry CRLF bytes through to the PSGI server. If the server does not ...

CVE-2026-93710

Dancer2 for Perl (versions 2.0.0 through before 2.2.0 ) contains a logic flaw in compile_hooks: when a hook dies and the exception handler halts the response, a subsequent cleanup call discards the request, response, and session objects before the dispatcher reads them. This causes the refused ro...

CVE-2026-93709

Dancer2 versions before 2.2.0 for Perl contain a path-normalization bypass in the AutoPage handler (disabled by default, enabled via auto_page). The handler compares the request path against the layout directory name as plain text, while the subsequent file lookup canonicalises the path. This mis...

CVE-2026-94492

A SQL injection vulnerability exists in Yonyou U8cloud 5.x , specifically in the OpenAPI component at the endpoint /u8cloud/openapi/so.saleorder.sendaudit. Manipulation of the operator argument allows a remote attacker with low privileges to inject SQL, leading to low impact on confidentiality, i...

CVE-2026-76974

CVE-2026-76974 affects SAP Fiori Launchpad , where insufficient validation of certain user-controlled input allows an unauthenticated attacker to craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location . ...

CVE-2026-94491

Yonyou KSOA 9.0 contains a SQL injection vulnerability in the file /cardcase/search_list.jsp , triggered by manipulating the address argument. The attack can be launched remotely without authentication (CVSS 3.1 score: 7.3 , HIGH). The vendor was contacted but did not respond , and no official pa...

CVE-2026-94490

CVE-2026-94490 affects OctoPrint 1.0.0 , specifically the executeSystemCommand function in src/octoprint/server/api/system.py (the Command API component). The vulnerability is an OS command injection triggered by manipulating the command argument. The attack can be initiated remotely but requires...

CVE-2026-79313

web.py 0.76 (a lightweight Python web framework by the webpy project) is affected by an Insufficient Session Expiration flaw. The root cause lies in how sessions are managed: expiration is enforced only via periodic cleanup rather than by checking the last-access time at load time. Consequently, ...

CVE-2026-79312

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session.load reads sessionid directly from the request cookie and loads that session from the store, and save writes back under the same sessionid; no rotation after authentication, so a fixed sessionid keeps the authenticated sta...

CVE-2026-79314

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2 , a web-based proxy management panel. The root cause is that the update endpoint fails to verify that the target resource belongs to the requesting session user. An authenticated user can modify another user's inbound proxy conf...

CVE-2026-79311

webpy (web.py) version 0.76 is vulnerable to Cross-Site Scripting (XSS) through the render_jinja.__init__() function. The vulnerability allows injected script to be executed in a user's browser when the Jinja rendering path is invoked. No specific affected version range beyond 0.76, remediation d...

CVE-2026-79315

CVE-2026-79315 is a reflected cross-site scripting (XSS) vulnerability in x-ui 0.3.2 , a VPN proxy management panel. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffec...

CVE-2026-94489

A path traversal vulnerability in OctoPrint 1.0.0 affects the _validate function in src/octoprint/server/api/files.py (File Download API). Manipulation of the filename argument allows a remote attacker with low privileges to traverse directories, resulting in low confidentiality impact . The expl...

CVE-2026-94426

xuxueli xxl-job up to version 3.5.0 is affected by a cross-site scripting (XSS) vulnerability in the /jobgroup/insert endpoint. The flaw is triggered by manipulating the Name argument, allowing a remote attacker to inject scripts that execute in a victim's browser. The CVSS 3.1 score is 3.5 (LOW)...

CVE-2026-94425

CVE-2026-94425 affects the Moore Threads MTT S80 Driver Package 340.150 , specifically the IOCTL Handler in the driver library mtdispkm64.sys (function sub_140006F0C). The root cause is improper privilege management , allowing a local attacker with low privileges to escalate access. The CVSS 3.1 ...

CVE-2026-94627

vLLM Mooncake connector (through version 0.29.0) fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. An unauthenticated remote attacker can trigger GPU memory exhaustion by submitting completi...

CVE-2026-94626

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints. In prefill/decode disaggregated deployments using NIXL, an unauthenticated remote attacker can supply an arbitrary tp_size value to allocate unbounded memory , ultimately t...

CVE-2026-94625

vLLM through 0.29.0 is affected by a resource exhaustion vulnerability in its MooncakeConnector component (used for KV-cache transfer). Rejected prefill requests create ownerless transfer placeholders that are never reclaimed, allowing a remote, unauthenticated attacker to exhaust sender task poo...

CVE-2026-94624

vLLM through version 0.29.0 contains a denial-of-service vulnerability in its P2P KV offloading subsystem. When the OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier, an unauthenticated remote attacker can supply arbitrary host and port values via kv_t...

CVE-2026-94623

vLLM through version 0.29.0 is affected by a denial of service vulnerability in the NIXL connector's prefix caching implementation. The root cause is a failure to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. An unauthenticated...