Rezultati pretraživanja za 'Od datuma: 27.12.2024.'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-126405 | 6.5 | Coder 2.21.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 reads Web Push endpoint responses in webpushSend with io.ReadAll, without a size limit or client timeout. Any authenticated user | 2026-11-13 10:17:45 | 2026-11-13 10:17:45 |
| CVE-2026-126402 | 7.2 | Fleet before 4.89.0 contains an incorrect authorization flaw in its user administration API that accepts user creation or modification when the caller administers any one of the assigned teams. Authenticated team administrators can grant users admini | 2026-11-13 10:17:44 | 2026-11-13 10:17:44 |
| CVE-2026-126401 | 7.5 | Fleet before 4.86.2 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory through quadratic XML canonicalization of unsigned SAML responses. Attackers can send a single crafted SAML response with de | 2026-11-13 10:17:44 | 2026-11-13 10:17:44 |
| CVE-2026-126398 | 5.9 | vLLM from 0.28.0 before 0.30.0 contains a reachable assertion vulnerability in GPUModelRunner._init_xdrope_positions that allows remote attackers to crash the engine by submitting embeddings-only requests. Attackers can send a /v1/completions request | 2026-11-13 10:17:44 | 2026-11-13 10:17:44 |
| CVE-2026-126397 | 7.5 | vLLM from 0.10.1 before 0.31.0 forwards a request-controlled mm_processor_kwargs.max_patches value to the Hugging Face processor for Cohere2 Vision models without a server-side upper bound, causing quadratic CPU work during multimodal preprocessing. | 2026-11-13 10:17:44 | 2026-11-13 10:17:43 |
| CVE-2026-126394 | 5.3 | vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vulnerability in OpenCVDynamicOpenPanguVideoBackend, which uses request-controlled num_frames without an effective ceiling. Unauthenticated attackers can send /v1/chat/completions or /tokenize | 2026-11-13 10:17:43 | 2026-11-13 10:17:43 |
| CVE-2026-126393 | 6.1 | SiYuan before 3.8.10 contains a server-side request forgery vulnerability in the skill-install download path because fetchBytes performs only a parse-time hostname check instead of using ssrfSafeClient. Attackers can supply a skill URL via the MCP sk | 2026-11-13 10:17:43 | 2026-11-13 10:17:43 |
| CVE-2026-126390 | 3.7 | n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API token to attacker-chosen hosts when downloading attachments. Attackers with write access to a NocoDB attachment cell can insert a | 2026-11-13 10:17:42 | 2026-11-13 10:17:42 |
| CVE-2026-126389 | 5.4 | n8n before 1.123.89 contains an authentication bypass vulnerability in the Chat Trigger that allows unauthenticated attackers to skip n8n User Auth through the setup GET webhook route in embedded chat mode. Attackers can send unauthenticated GET requ | 2026-11-13 10:17:42 | 2026-11-13 10:17:42 |
| CVE-2026-126386 | 4.7 | n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains an open redirect vulnerability in the unauthenticated MCP OAuth dynamic client registration flow, which accepts arbitrary redirect_uri values via the /mcp-oau | 2026-11-13 10:17:41 | 2026-11-13 10:17:41 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/12795
Zapisa po stranici: