Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.5 HIGH
CVE-2026-94491 — Yonyou KSOA search_list.jsp sql injection

A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/search_list.jsp. Executing a manipulation of the argument address can lead to sql injection. It i…

ksoa | Remote | Injection
Sep 22, 2026 Sep 22, 2026
Sep 22, 2026
Sep 22, 2026
0.0 NA
CVE-2026-93712 — Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via…

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without…

| Path Traversal
Sep 22, 2026 Sep 22, 2026
Sep 22, 2026
Sep 22, 2026
0.0 NA
CVE-2026-93711 — Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names …

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name. A name carry…

| Misconfiguration
Sep 22, 2026 Sep 22, 2026
Sep 22, 2026
Sep 22, 2026
0.0 NA
CVE-2026-93710 — Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refu…

Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks. A hook that dies fires core.app.hook_exce…

| Misconfiguration
Sep 22, 2026 Sep 22, 2026
Sep 22, 2026
Sep 22, 2026
0.0 NA
CVE-2026-93709 — Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelli…

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the la…

| Information Disclosure
Sep 22, 2026 Sep 22, 2026
Sep 22, 2026
Sep 22, 2026
5.3 MEDIUM
CVE-2026-76974 — Information Disclosure vulnerability in SAP Fiori Launchpad

SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the brow…

fiori_launchpad | Remote | Server-Side Request Forgery
Sep 22, 2026 Sep 22, 2026
Sep 22, 2026
Sep 22, 2026
5.8 MEDIUM
CVE-2026-94490 — OctoPrint Command API system.py executeSystemCommand os command injection

A security flaw has been discovered in OctoPrint 1.0.0. Affected by this issue is the function executeSystemCommand of the file src/octoprint/server/api/system.py of the component Command API. Perfor…

octoprint | Remote | Injection
Sep 22, 2026 Sep 22, 2026
Sep 22, 2026
Sep 22, 2026
4.3 MEDIUM
CVE-2026-94489 — OctoPrint File Download API files.py _validate path traversal

A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function _validate of the file src/octoprint/server/api/files.py of the component File Download API. Such mani…

octoprint | Remote | Path Traversal
Sep 22, 2026 Sep 22, 2026
Sep 22, 2026
Sep 22, 2026
4.0 MEDIUM
CVE-2026-94426 — xuxueli xxl-job insert cross site scripting

A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scrip…

xxl-job | Remote | Cross-Site Scripting
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
9.3 CRITICAL
CVE-2026-94425 — Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140006F0C privileges manage…

A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150. The affected element is the function sub_140006F0C in the library mtdispkm64.sys of the component IOCTL Handler. The manipul…

mtt_s80_driver_package | Authorization
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
8.7 HIGH
CVE-2026-94627 — vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision

vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Att…

vllm vllm | Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
8.7 HIGH
CVE-2026-94626 — vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbi…

vllm vllm | Remote | Misconfiguration
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
6.9 MEDIUM
CVE-2026-94625 — vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can se…

vllm vllm | Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
8.7 HIGH
CVE-2026-94624 — vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions

vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can …

vllm vllm | Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
8.7 HIGH
CVE-2026-94623 — vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion reques…

vllm vllm | Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
8.7 HIGH
CVE-2026-94622 — vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incompl…

vllm vllm | Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
7.7 HIGH
CVE-2026-94540 — DesktopSMS 1.11.0 Unauthorized Access via Local Service

DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attackers to transmit SMS, retrieve SMS-derived content, and persist an attacker-selected paired identity b…

| Authentication
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
5.3 MEDIUM
CVE-2026-94536 — lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource

lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can…

lamp-cloud lamp-cloud | Remote | Authorization
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
7.1 HIGH
CVE-2026-94535 — lamp-cloud through 5.10.0 Unauthorized Notification Deletion

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DE…

lamp-cloud lamp-cloud | Remote | Authorization
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
7.1 HIGH
CVE-2026-94534 — lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can s…

lamp-cloud lamp-cloud | Remote | Authentication
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
Showing 20 of 13867 Results