#CVE

共收录 63886 条相关情报。

漏洞预警2026-10-25 发布MEDIUM

vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids...

CVE-2026-116181

vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash

来源摘录 · NVD

#cve #cwe-129

漏洞预警2026-10-25 发布HIGH

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner le...

CVE-2026-116180

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates

来源摘录 · NVD

#cve #cwe-908

漏洞预警2026-10-25 发布HIGH

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through med...

CVE-2026-116179

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-25 发布HIGH

vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the dis...

CVE-2026-116178

vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engi

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-25 发布HIGH

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL proces...

CVE-2026-116177

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated a

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-25 发布HIGH

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-R...

CVE-2026-116176

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outb

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-25 发布MEDIUM

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration ...

CVE-2026-116175

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path call

来源摘录 · NVD

#cve #cwe-409

漏洞预警2026-10-25 发布HIGH

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs ...

CVE-2026-116174

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and Generat

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-25 发布HIGH

vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust ...

CVE-2026-116173

vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate Engi

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-25 发布HIGH

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via Cand...

CVE-2026-116172

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allow

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-25 发布MEDIUM

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and m...

CVE-2026-116171

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows ex

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-25 发布MEDIUM

SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can ...

CVE-2026-116170

SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injec

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-25 发布MEDIUM

SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math ...

CVE-2026-116169

SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permiss

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-25 发布MEDIUM

SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .e...

CVE-2026-116168

SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relie

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-25 发布MEDIUM

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTP...

CVE-2026-116166

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port kee

来源摘录 · NVD

#cve #cwe-319

漏洞预警2026-10-25 发布INFO

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete...

CVE-2026-116165

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB de

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-25 发布INFO

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fi...

CVE-2026-116164

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client obje

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-25 发布INFO

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification co...

CVE-2026-116162

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when i

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-25 发布INFO

Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or ...

CVE-2026-116161

Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuer

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-25 发布LOW

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a ma...

CVE-2026-116160

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation

来源摘录 · NVD

#cve #cwe-122