#cwe-345

共收录 416 条相关情报。

← 返回所有主题

安全公告2026-10-23 发布INFO

vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

CVE-2026-114050

## Summary Multimodal content parts (`image_url`, `video_url`, `input_audio`, ...) accept a user-supplied `uuid` field

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-345 #severity:medium

安全公告2026-10-23 发布INFO

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

CVE-2026-62204

## Summary `installBazaarPlugin` (and the equivalent endpoints for widgets/icons/templates/themes) accept `packageName`

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-345 #cwe-668 #severity:medium

漏洞预警2026-10-23 发布HIGH

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any late...

CVE-2026-56832

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval app

来源摘录 · NVD

#cve #cwe-345 #cwe-863

漏洞预警2026-10-22 发布CRITICAL

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses on...

CVE-2026-114612

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3

来源摘录 · NVD

#cve #cwe-269 #cwe-345 #cwe-441

安全公告2026-10-21 发布INFO

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no...

CVE-2026-114050

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-345 #severity:high

漏洞预警2026-10-21 发布INFO

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers ...

CVE-2026-114050

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-10-20 发布INFO

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but ...

CVE-2026-112939

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged proces

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-10-20 发布INFO

A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permane...

CVE-2026-43835

A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

安全公告2026-10-16 发布INFO

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

CVE-2026-76894

## Summary The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-345 #cwe-940 #severity:low

安全公告2026-10-15 发布INFO

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

CVE-2026-102682

Pipecat’s built-in development runner exposes endpoints that create bot sessions and, for the Daily transport, paid Dail

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-345 #cwe-770 #cwe-862 #severity:medium

漏洞预警2026-10-15 发布HIGH

Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verif...

CVE-2026-55103

Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, i

来源摘录 · NVD

#cve #cwe-345 #cwe-863

漏洞预警2026-10-14 发布MEDIUM

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in developm...

CVE-2026-102682

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.9

来源摘录 · NVD

#cve #cwe-345 #cwe-770 #cwe-862

漏洞预警2026-10-13 发布INFO

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware up...

CVE-2026-102250

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be up

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

安全公告2026-10-13 发布INFO

A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the...

CVE-2026-108971

A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-345 #severity:high

漏洞预警2026-10-13 发布INFO

A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Execut...

CVE-2026-108971

A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bi

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-347

漏洞预警2026-10-12 发布INFO

Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were...

CVE-2026-49483

Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-732

漏洞预警2026-10-12 发布INFO

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies ...

CVE-2026-109365

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to forc

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-10-12 发布INFO

Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generatio...

CVE-2026-109359

Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

安全公告2026-10-12 发布INFO

Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies

CVE-2026-109365

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to forc

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-345

安全公告2026-10-12 发布INFO

Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery

CVE-2026-109359

Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-345