Netty before 4.1.138.Final ByteBuf Leak in StompSubframeDecoder
CVE-2026-100657
Netty's STOMP codec (io.netty:netty-codec-stomp) contains a ByteBuf leak in StompSubframeDecoder. Once a frame's declare
#advisory
共收录 23334 条相关情报。
← 返回所有主题Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining
CVE-2026-100656
Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec t
Netty before 4.1.138.Final Denial of Service via SpdySessionHandler
CVE-2026-100655
Netty (io.netty:netty-codec-http) versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final a
vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids
CVE-2026-100654
vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/cha
vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation
CVE-2026-100653
vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-
vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids
CVE-2026-100652
vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC fron
vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass
CVE-2026-100651
vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1
vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization
CVE-2026-100650
vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls
vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass
CVE-2026-100649
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler sub
vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding
CVE-2026-100648
vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing un
vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt
CVE-2026-100647
vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-com
SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header
CVE-2026-100646
SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authen
SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban
CVE-2026-100645
SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database re
SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath
CVE-2026-100644
SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath para
SiYuan before v3.8.4 Stored XSS via Attribute View textarea
CVE-2026-100643
SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing a
SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth
CVE-2026-100642
SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-scree
SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
CVE-2026-100641
SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager l
SiYuan before v3.8.4 Clipboard Data Disclosure via IPC
CVE-2026-100640
SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderer
SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL
CVE-2026-100639
SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutt
SiYuan before v3.8.4 Path Traversal via setNotebookIcon
CVE-2026-100638
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authent