CVE Vulnerability Catalog

Prior to 0.32.0, vLLM's ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can dispatch an EPS payload to host components; a host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers.

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key.

HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent.

HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission.

Vulnerability in the Object Transfer Service (OTS) server in the Zephyr Bluetooth stack. The oacp_ind_send() function appends the Checksum Value field to the OACP response regardless of the result code, while the response buffer is only filled on the success path. On validation failure (e.g., no object selected), net_buf_simple_pull_le32() is invoked on a zero-length buffer.

Johnson Controls Kantech Entrapass before 9.20 uses a hard-coded cryptographic key, allowing a padding oracle crypto attack.

In GStreamer Editing Services (gst-editing-services), a GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When loaded, the pipeline description is parsed and instantiated without restriction on elements or properties, allowing a remote attacker to read or write arbitrary local files, issue outbound network requests, or crash the application.

Prior to 0.32.0, an authenticated caller in vLLM can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled.

From 1.3.0 until 9.0.0, the Rust zip library's ZipArchive::extract calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, aborting the process in a way that cannot be contained with catch_unwind or a worker thread.

From 7.2.0 until 9.0.0, the Rust zip library's ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows the extraction destination can create a chain whose apparent target stays under the destination while an intermediate symlink resolves outside it, allowing files to be created or overwritten with the extracting process's privileges.

The zip library for Rust, from 5.1.0 until 9.0.0, with the legacy-zip feature enabled, reserves output capacity based on an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service.

SQL injection in the database-query custom resource handlers in the AWS Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, including granting access to all cluster users. The statements are reachable through crafted user names, comments, or passwords.

The Windows driver for the HUION Inspiroy Frego S (L310) version 20.0.1.118 contains a DLL-loading vulnerability in the installer logic. A local attacker can exploit this to execute arbitrary code.

The homestay-backend 0.0.1-SNAPSHOT application contains an IDOR vulnerability in ChatServiceImpl. An authenticated user can view conversations, read and send messages, and mark messages as read for arbitrary conversation IDs because the service does not verify that the caller is a conversation participant.

Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform is vulnerable to bucket squatting. An attacker can intercept and access proprietary source code, execute arbitrary code, and exfiltrate data.

Open5GS versions 1.3.0 through 2.8.0 contain a heap out-of-bounds write vulnerability in parse_multipart(). An unauthenticated attacker can corrupt memory by supplying an empty multipart boundary.

Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects and then build and query DiskANN indexes over crafted values.

A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2 affecting packages/client/connection/src/browser-auth.ts in the Browser Auth component. The manipulation causes improper authorization and can be initiated remotely.

Apache Vysper, an XMPP (Jabber) server library, in all versions is missing an authentication check in its XEP-0077 (In-Band Registration) implementation. Any authenticated user can compromise other accounts. The project is retired and no fix will be released.

Apache Vysper, an XMPP (Jabber) server library, in all versions contains unbounded allocation in XML parsing, which may lead to an out-of-memory condition. The project is retired and no fix will be released.