CVE Vulnerability Catalog

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests.

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the Search Engine component. Manipulation of the Query argument can lead to cross site scripting.

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Join(drv.root, name) from the attacker-supplied `name` field of a Docker VolumeDriver.Create request without verifying that the result stays within drv.root (default /var/lib/docker-volumes/rclone), and checkMountpoint() then creates that directory with file.MkdirAll before mounting. A volume name containing enough `..` components (e.g. "../../../../../../etc") therefore resolves outside the base directory, allowing anyone able to submit a VolumeDriver.Create request to the plugin socket to make the privileged rclone plugin process create a directory and mount a remote filesystem at an arbitrary host path. Volume.restoreState() had the same missing validation when reloading persisted volume state. Fixed in 1.75.1.

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape.

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints. This allows a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor. This allows unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to.

The Business Name Generator WordPress plugin through version 1.3 does not sanitise and escape some of its settings. This could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

In Vinyl Cache before 9.0.2, a workspace buffer overflow vulnerability exists in the .upper() and .lower() string methods of VCL. It can be used as a remote denial of service vector causing the child process to segfault or assert and restart.

In Suricata from 8.0.0 until 8.0.6, a locally supplied detection rule combining frame inspection without content and a transformed match without content can make src/detect-engine-prefilter.c select multiple non-prefilter frame engines. Loading the crafted rule, including in test mode, can trigger a heap buffer overflow and crash Suricata.

In Suricata prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverable protocol event. The fatal state disables FTP parsing for the remainder of the TCP flow, allowing later commands to evade parser-dependent rules and logging; IPS mode instead drops the flow.

Suricata from 8.0.0 to 8.0.6 has a vulnerability in the SIP parser where request and response body lengths are stored in 16-bit fields. A body larger than 65,536 bytes can truncate the length, preventing full frame inspection and allowing evasion of frame-based detection.

Suricata from 8.0.0 to 8.0.6 has a vulnerability in src/datasets-context-json.c where it assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A non-string value for that key can cause a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing.

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing out-of-bounds writes that corrupt concurrent requests' sampler state and alter repetition penalty behavior.

vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow concurrent requests to sample tokens outside their allowlists.

Suricata prior to 7.0.17 and 8.0.6 has a vulnerability in HTTP SWF decompression when the non-default swf-decompression feature and an unsafe decompress-depth are used. The allocation can use the configured depth instead of limiting to the Flash file's actual data requirement, leading to an integer-related heap buffer overflow and crash of Suricata.

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing authorization checks.

In Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14, the get_client_ip function in saleor/account/throttling.py allows bypassing authentication attempt throttling by spoofing the client IP. The vendor considers this intended behavior, stating that XFF should be configured properly. The exploit has been publicly disclosed.

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies. An attacker can manipulate the content of log files.

SysReptor prior to 2026.68 does not rotate the session identifier after successful password authentication for protected shared notes, allowing session fixation. An attacker can reuse the fixed session after the victim authenticates to the shared note. The main SysReptor login flow is not affected.