#CVE

共收录 69142 条相关情报。

漏洞预警2026-10-21 发布INFO

SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. At...

CVE-2026-114060

SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-10-21 发布HIGH

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because G...

CVE-2026-114059

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-o

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-21 发布INFO

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metada...

CVE-2026-114058

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that let

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-21 发布INFO

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. ...

CVE-2026-114057

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that all

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-21 发布MEDIUM

ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UP...

CVE-2026-114056

ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-21 发布HIGH

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-...

CVE-2026-114055

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-21 发布MEDIUM

vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF Im...

CVE-2026-114054

vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache k

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-21 发布HIGH

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revisio...

CVE-2026-114053

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProces

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-21 发布HIGH

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_proce...

CVE-2026-114052

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-21 发布HIGH

vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught ...

CVE-2026-114051

vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens,

来源摘录 · NVD

#cve #cwe-248

漏洞预警2026-10-21 发布HIGH

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers ...

CVE-2026-114050

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache

来源摘录 · NVD

#cve #cwe-345

漏洞预警2026-10-21 发布LOW

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_id...

CVE-2026-114049

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain

来源摘录 · NVD

#cve #cwe-440

漏洞预警2026-10-21 发布INFO

WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check. Att...

CVE-2026-114048

WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-21 发布INFO

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification modul...

CVE-2026-114047

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts unt

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-10-21 发布MEDIUM

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malici...

CVE-2026-114046

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null p

来源摘录 · NVD

#cve #cwe-476

漏洞预警2026-10-21 发布INFO

FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alig...

CVE-2026-114045

FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparo

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-10-21 发布MEDIUM

FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvali...

CVE-2026-114044

FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP s

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-21 发布INFO

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer fo...

CVE-2026-114043

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winp

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-21 发布INFO

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than t...

CVE-2026-114042

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the ow

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-10-21 发布MEDIUM

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A maliciou...

CVE-2026-114041

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a

来源摘录 · NVD

#cve #cwe-125