CVE Notifier

CVE-2026-93841 CWE-129 3.7

vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can…

cve.org vllm-project:vllm 1 hari lalu

CVE-2026-93840 CWE-129 3.7

vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids

vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary tha…

cve.org vllm-project:vllm 1 hari lalu

CVE-2026-93839 CWE-306 9.8

LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer addre…

cve.org ModelTC:LightLLM 1 hari lalu

CVE-2026-93838 CWE-770 5.9

SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx

SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attac…

cve.org sgl-project:sglang 1 hari lalu

CVE-2026-11548 CWE-444 4.8

Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.

cve.org IBM:CICS · TX · Advanced 1 hari lalu

CVE-2026-11545 CWE-862 3.7

IBM WebSphere Application Server is affected by a privilege escalation

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing authorization checks.

cve.org IBM:WebSphere · Application · Server 1 hari lalu

CVE-2026-11540 CWE-863 5.3

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

cve.org IBM:WebSphere · Application · Server 1 hari lalu

CVE-2026-11539 CWE-306 5.3

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX connector.

cve.org IBM:WebSphere · Application · Server 1 hari lalu

CVE-2026-75895 CWE-125 N/A

Out of bounds read at smpp34_unpack()

In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34_unpack() function via attacker controlled SMPP PDUs, leading to memory corruption.

cve.org Osmocom:libsmpp34 1 hari lalu

CVE-2017-20284 CWE-22 7.5

Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig Servlet

Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request…

cve.org Caucho · Technology, · Inc.:Resin 1 hari lalu

CVE-2026-11538 CWE-117 3.7

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies.

cve.org IBM:WebSphere · Application · Server 1 hari lalu

CVE-2021-48008 CWE-89 7.5

Chanjet CRM SQL Injection via get_usedspace.php

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploi…

cve.org Chanjet · Information · Technology 1 hari lalu