#cwe-129

共收录 141 条相关情报。

← 返回所有主题
漏洞预警2026-09-23 发布INFO

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can sup...

CVE-2026-96675

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate spar

历史摘要 · 未重新核验 · NVD

安全公告2026-09-23 发布INFO

alsa-lib through 1.2.16.1 Denial of Service via pcm_multi

CVE-2026-96675

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate spar

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-20 发布INFO

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's...

CVE-2026-93989

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in Sa

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-19 发布LOW

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can suppl...

CVE-2026-93989

该漏洞存在于 vLLM 至 0.29.0 版本。vLLM 是当前广泛使用的高吞吐大模型推理与服务框架, 其核心能力是把多个 in-flight 请求打包成批次 (continuous batching) 在同一进程与 GPU 上并行解码,

历史摘要 · 未重新核验 · NVD

安全公告2026-09-18 发布INFO

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel...

CVE-2026-93841

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs ind

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-18 发布INFO

vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output...

CVE-2026-93840

vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in Sampling

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-18 发布INFO

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds chec...

CVE-2026-93841

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs ind

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can suppl...

CVE-2026-93840

vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in Sampling

历史摘要 · 未重新核验 · NVD

安全公告2026-09-18 发布INFO

vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs

CVE-2026-93841

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs ind

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-18 发布INFO

vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids

CVE-2026-93840

vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in Sampling

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-18 发布INFO

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1,...

CVE-2026-63635

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1,...

CVE-2026-63420

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

历史摘要 · 未重新核验 · NVD

安全公告2026-09-18 发布INFO

OpenImageIO: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoS

CVE-2026-63635

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-18 发布INFO

OpenImageIO: PSD RawColor indexed image out-of-bounds read in `interleave_row`

CVE-2026-63420

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-18 发布INFO

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by...

CVE-2026-93592

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints,

历史摘要 · 未重新核验 · NVD

安全公告2026-09-18 发布INFO

vLLM before 0.28.0 Denial of Service via negative token ID

CVE-2026-93592

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints,

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-16 发布INFO

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote ...

CVE-2026-91101

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-10 发布INFO

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE de...

CVE-2026-49838

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-10 发布INFO

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared unichar count as a loop bound a...

CVE-2026-88052

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharse

历史摘要 · 未重新核验 · NVD

安全公告2026-09-10 发布INFO

Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization

CVE-2026-88052

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharse

历史摘要 · 未重新核验 · OSV.dev