Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attack…
libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly …
Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block l…
libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. A…
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers ex…
SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent a…
sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoint…
SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied…
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can …
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers kno…
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by…
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers …
RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attacke…
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744.
A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in har…
A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file src/speaches/executor…
A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation c…
A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. Performing a manipula…
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Att…
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can ca…