Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
8.7 HIGH
CVE-2026-94627 — vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision

vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Att…

vllm | Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
8.7 HIGH
CVE-2026-94626 — vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbi…

vllm | Remote | Misconfiguration
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
6.9 MEDIUM
CVE-2026-94625 — vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can se…

vllm | Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
8.7 HIGH
CVE-2026-94624 — vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions

vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can …

vllm | Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
8.7 HIGH
CVE-2026-94623 — vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion reques…

vllm | Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
8.7 HIGH
CVE-2026-94622 — vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incompl…

vllm | Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
7.7 HIGH
CVE-2026-94540 — DesktopSMS 1.11.0 Unauthorized Access via Local Service

DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attackers to transmit SMS, retrieve SMS-derived content, and persist an attacker-selected paired identity b…

| Authentication
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
5.3 MEDIUM
CVE-2026-94536 — lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource

lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can…

lamp-cloud | Remote | Authorization
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
7.1 HIGH
CVE-2026-94535 — lamp-cloud through 5.10.0 Unauthorized Notification Deletion

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DE…

lamp-cloud | Remote | Authorization
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
7.1 HIGH
CVE-2026-94534 — lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can s…

lamp-cloud | Remote | Authentication
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
7.1 HIGH
CVE-2026-94533 — lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users'…

lamp-cloud | Remote | Authorization
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
7.1 HIGH
CVE-2026-94532 — lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate t…

lamp-cloud | Remote | Authorization
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
7.4 HIGH
CVE-2026-93340 — Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting t…

Remote | Authentication
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
0.0 NA
CVE-2026-88756 — Pagekit CMS SQL Injection

Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint (POST /user/authenticate).

| Injection
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
0.0 NA
CVE-2026-88738 — Jazzware RT1000 Edge Unrestricted File Upload Remote Code Execution

Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An authenticated attacker can upload a server-side executable file…

| Authentication
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
0.0 NA
CVE-2026-79079 — CrossWire Xiphos Arbitrary Code Execution Vulnerability

An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components

| Memory Corruption
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
0.0 NA
CVE-2026-78847 — gray-matter Arbitrary Code Execution

An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code ex…

| Injection
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
0.0 NA
CVE-2026-78806 — Matter Project Chip Information Disclosure Vulnerability

An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive information via the PerformCommissioningStep function in the…

| Information Disclosure
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
7.9 HIGH
CVE-2026-65980 — Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substituti…

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugin…

Remote | Injection
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
5.8 MEDIUM
CVE-2026-61852 — Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery() implementation in server/modules/…

Remote | Injection
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
Showing 20 of 13804 Results