#CVE

共收录 69142 条相关情报。

漏洞预警2026-10-25 发布MEDIUM

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS reque...

CVE-2026-116193

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticat

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-25 发布MEDIUM

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by sup...

CVE-2026-116192

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attacker

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-25 发布LOW

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to differen...

CVE-2026-116190

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-25 发布HIGH

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS...

CVE-2026-116189

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums fro

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-25 发布MEDIUM

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attacke...

CVE-2026-116188

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory acco

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-25 发布MEDIUM

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipa...

CVE-2026-116187

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows a

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-25 发布INFO

OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only throug...

CVE-2026-116186

OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-25 发布MEDIUM

OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiv...

CVE-2026-116185

OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read oth

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-25 发布INFO

OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the g...

CVE-2026-116184

OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-25 发布MEDIUM

phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can i...

CVE-2026-116182

phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches exter

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-25 发布MEDIUM

vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids...

CVE-2026-116181

vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash

来源摘录 · NVD

#cve #cwe-129

漏洞预警2026-10-25 发布HIGH

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner le...

CVE-2026-116180

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates

来源摘录 · NVD

#cve #cwe-908

漏洞预警2026-10-25 发布HIGH

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through med...

CVE-2026-116179

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-25 发布HIGH

vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the dis...

CVE-2026-116178

vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engi

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-25 发布HIGH

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL proces...

CVE-2026-116177

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated a

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-25 发布HIGH

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-R...

CVE-2026-116176

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outb

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-25 发布MEDIUM

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration ...

CVE-2026-116175

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path call

来源摘录 · NVD

#cve #cwe-409

漏洞预警2026-10-25 发布HIGH

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs ...

CVE-2026-116174

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and Generat

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-25 发布HIGH

vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust ...

CVE-2026-116173

vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate Engi

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-25 发布HIGH

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via Cand...

CVE-2026-116172

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allow

来源摘录 · NVD

#cve #cwe-20