All CVEs — page 1124 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
The vulnerability in Moore Threads MTT S80 Driver Package 340.150 allows for improper privilege management, enabling local attackers to exploit it for high impact consequences.
The vLLM Mooncake connector has a memory management flaw where GPU KV cache blocks aren't properly released when concurrent requests share the same transfer ID, leading to gradual memory exhaustion that eventually prevents legitimate requests from processing.
The vLLM library fails to validate the tp_size parameter in kv_transfer_params, allowing unbounded memory allocation during prefill/decode operations. This vulnerability can lead to memory exhaustion and kernel OOM-kill of decode worker processes.
The vulnerability allows attackers to send rejected prefill requests that create ownerless transfer placeholders, leading to resource exhaustion and delayed processing of valid requests.
The vulnerability allows attackers to cause a denial of service by configuring vLLM with specific P2P KV offloading settings that create unreachable peer sessions, leading to ZeroMQ socket exhaustion and EngineCore crashes. This affects inference services that use the affected offloading features.
The vLLM library has a denial of service vulnerability in its NIXL connector's prefix caching implementation that fails to properly validate block counts when handling multiple prompts in prefill/decode deployments, leading to assertion failures and worker termination.
The flaw allows attackers to cause a denial of service by sending requests with incomplete metadata entries, leading to engine termination and failure of routed requests.
DesktopSMS 1.11.0 allows local attackers to perform unauthorized SMS operations by interacting with the local service, potentially leading to the transmission and retrieval of SMS content and the persistence of attacker-controlled identities.
The flaw allows authenticated users to read any employee's roles and permissions by exploiting the unvalidated employeeId parameter, posing a security risk.
The vulnerability allows authenticated users to delete other users' notifications without proper validation, enabling unauthorized data modification.
The flaw allows authenticated attackers to modify any user's profile fields, including nicknames and avatars, by exploiting PUT requests to specific endpoints.
This vulnerability allows authenticated users to download any file stored by other users due to a lack of proper file ownership validation, enabling unauthorized access to sensitive information.
The flaw allows authenticated users to read other users' full profiles, including sensitive information like mobile numbers and national identity card numbers.
The flaw allows unauthenticated attackers to exploit a password reset link poisoning vulnerability by manipulating the client-supplied origin parameter, leading to potential full account takeover.
The Jazzware RT1000 Edge webUI v. 20.0.1 allows an attacker with administrative privileges to upload a server-side executable file, leading to remote code execution.
A local attacker can execute arbitrary code in CrossWire Xiphos <= 4.3.2 by exploiting vulnerabilities in the src/main/url.cc and src/gtk/menu_popup.c components, allowing for full control over the application.
The flaw allows arbitrary code execution via the JavaScript engine parsing front matter when the language is set to js/javascript, posing a critical security risk.