vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal...
CVE-2026-56340
vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because P
#severity:high
共收录 5499 条相关情报。
← 返回所有主题WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows...
CVE-2020-37255
WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attack
The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to...
CVE-2026-11912
The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization
The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to...
CVE-2026-11911
The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat
Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to...
CVE-2026-56215
Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, whi
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to...
CVE-2026-9843
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion
Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey...
CVE-2026-56216
Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows ap
Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC...
CVE-2026-56214
Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org
Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the...
CVE-2026-56082
Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST
Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST...
CVE-2026-56079
Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-
Anki's local HTTP server does not sufficiently validate requests
## Summary Anki launches a local HTTP server to serve media files and web pages for parts of its interface. The server
SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter
SurrealDB's full-text search lets you define a text analyzer whose `mapper` filter loads a term-mapping file from disk (
Lokka: Azure Resource Manager URL path validation issue
Lokka versions prior to 2.1.2 constructed Azure Resource Manager request URLs using direct string concatenation with use
@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing
## Arbitrary Cloudinary API Parameter Signing in @jhb.software/payload-cloudinary-plugin ### Summary `@jhb.software/pa
LangSmith SDK TracingMiddleware: Arbitrary server-side file read
# Summary An attacker who can send an HTTP request to a server running the LangSmith SDK's `TracingMiddleware` can caus
githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow
### Summary A GitHub Actions workflow is vulnerable to command injection through the issue title. The workflow is trig
appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)
## Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI) ### Summary `appium-mcp`'s `createLocatorG
EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id
EverOS versions 1.0.0 and earlier are vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint. Th
Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
## Impact Uni-CLI versions before 0.225.2 exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without valid
stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)
### Summary On a multi-tenant stigmem node, a caller holding a `write` credential for **one** tenant can run a decay swe