Tagged “cve.org”
CVEs tagged cve.org, newest first.
47259 CVEsRSS
CVE-2026-116395Medium· 6.5WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through 1.2.0.
CVE-2026-115911Medium· 6.5vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can …
CVE-2026-116612High· 7.8A flaw was found in GStreamer Editing Services (gst-editing-services)
A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing applicat…
CVE-2026-106676Medium· 5.4qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value
qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes …
CVE-2026-115913Medium· 6.5vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one legal l…
CVE-2026-116384Medium· 6.3PoCBdtask Garage 24 Garage Management Software Backend improper authorization
A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.0. This vulnerability affects unknown code of the component Backend. Executing a manipulation can lead to improper authorization. The attack can be launched …
CVE-2026-72755Low· 3.8Routinator stores TA certificate in cache without validation
Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails.
CVE-2026-72753High· 8.2Routinator incorrectly handles delta updates
When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.
CVE-2026-116385Low· 3.5PoCBdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting
A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /edit_profile of the component Profile. The manipulation of the argument first_name/las…
CVE-2026-72756High· 7.5Routinator exits on malformed rsync URIs
Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names.
CVE-2026-72754High· 7.5Routinator exits when parsing an incorrect or very large CRL file
When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong encoding, it may exit.
CVE-2026-72752Medium· 6.5Routinator exits when requesting the output repeatedly
Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. Additionally Routinator runs…
CVE-2026-72757Medium· 5.3Routinator HTTP server becomes unavailable with many unclosed connections
Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of co…
CVE-2026-115916Medium· 6.5vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass valid…
CVE-2026-72758High· 7.5Routinator may exit on malformed ranges
When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.
CVE-2026-102649Critical· 9.9PoCBurrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset
Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set i…
CVE-2026-115917Low· 3.4vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim…
CVE-2026-115914Medium· 6.5vLLM DeepSeek-OCR image processing vulnerable to denial of service
vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal…
CVE-2026-81509Medium· 6.1nforwardauth: Unvalidated r parameter allows post-authentication open redirect
nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites. Versions prior to 1.5.1 accept an unvalidated `r` query parameter on the `/login` endpoint and use them as the post-auth…
CVE-2026-115918Medium· 6.5vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when n…
CVE-2026-115921Medium· 6.2ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9 do not safely validate the requ…
CVE-2026-116400Medium· 6.5WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through 1.2.7.
CVE-2026-116398Medium· 6.5WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Content Slider Block content-slider-block allows Stored XSS.This issue affects Content Slider Block: from n/a through 3.2.1.
CVE-2026-115922Medium· 6.2ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, _unpack_2bit() and _unpack_4bit() resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying …
CVE-2026-112839Medium· 4.3WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability
Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-customer-coupons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Coupons for WooCommerce: from n/a…
CVE-2026-115966Medium· 6.5WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Typing Text – Give your texts many typing effects text-typing allows Stored XSS.This issue affects Typing Text – Give your tex…
CVE-2026-111404Low· 3.7WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Leveraging Race Conditions.This issue affects Photo Reviews fo…
CVE-2026-116408Medium· 6.5WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.
CVE-2026-116367Medium· 6.3PoCDeepSeek Harness sandbox.ts createContext
A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is pos…
CVE-2026-112346Critical· 9.8OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with…