https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 04:42:21 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-92365 <p>A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.</p> <p>A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.</p> https://db.gcve.eu/vuln/fkie_cve-2026-92365 https://db.gcve.eu/vuln/ghsa-mcqv-hjvx-mmqr <p>A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.</p> <p>A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.</p> https://db.gcve.eu/vuln/ghsa-mcqv-hjvx-mmqr https://db.gcve.eu/vuln/opensuse-su-2026:11867-1 <p>python313-vllm-0.30.0-1.1 on GA media</p> <p>python313-vllm-0.30.0-1.1 on GA media</p> https://db.gcve.eu/vuln/opensuse-su-2026:11867-1 https://db.gcve.eu/vuln/rhsa-2026:84734 <p>Cohere North AI: Cohere North AI: Arbitrary user information overwrite via incorrect access control Cohere North AI: Cohere North AI: Information disclosure via improper Origin header validation Cohere North AI: Cohere North AI: Information Leak via WebSocket Endpoint urllib3: urllib3 Streaming API improperly handles highly compressed data python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting fast-uri: fast-uri: URI authority bypass due to improper delimiter handling undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite urllib3: urllib3: Denial of Service via decompression bomb bypass with Brotli support org.eclipse.parsson/parsson: Eclipse Parsson: Denial of Service via uncontrolled resource consumption in JSON parsing undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 form-data: form-data: Form field override via CRLF injection undici: undici: Denial…</p> <p>Cohere North AI: Cohere North AI: Arbitrary user information overwrite via incorrect access control Cohere North AI: Cohere North AI: Information disclosure via improper Origin header validation Cohere North AI: Cohere North AI: Information Leak via WebSocket Endpoint urllib3: urllib3 Streaming API improperly handles highly compressed data python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting fast-uri: fast-uri: URI authority bypass due to improper delimiter handling undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite urllib3: urllib3: Denial of Service via decompression bomb bypass with Brotli support org.eclipse.parsson/parsson: Eclipse Parsson: Denial of Service via uncontrolled resource consumption in JSON parsing undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 form-data: form-data: Form field override via CRLF injection undici: undici: Denial…</p> https://db.gcve.eu/vuln/rhsa-2026:84734