CVE Vulnerability Catalog

In vLLM before 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing character and length restrictions, which can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate.

In vLLM before 0.30.0, flash late-interaction scoring at /score and /rerank derives query_key from the caller-controlled X-Request-Id header, allowing a concurrent request to overwrite the cached query embedding of a victim.

In vLLM before 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors, cache identifiers, ranges, and wire-selected multimodal field processors without rebinding them to the active model renderer contract, which can terminate EngineCore, poison cache, or alter transport semantics.

In vLLM before 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during rendering and before engine admission, while the receiver cache never receives the payload if the request is rejected, causing an assertion error on later reuse.

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through POST /v1/responses requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation prefix in the global unsalted cache namespace even when the caller enabled salting. On deployments with prefix caching enabled (default), an authenticated tenant who can reconstruct a victim's low-entropy post-tool history can submit the same continuation and use the cached_tokens_per_turn count to determine whether the prefix was previously processed, defeating tenant isolation.

In girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, the function mysqli_query in locateus.php (Doctor Search Endpoint) is vulnerable to SQL injection via the doctorname argument. The attack can be performed remotely, and the exploit is publicly available.

In girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, in get_town.php (AJAX Endpoint), manipulation of arguments countryid/townid/cid/didval/cidval leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

GraphQL Tools prior to 12.0.1, in the mergeDeep function of the utils package, does not exclude __proto__, constructor, or prototype keys while recursively merging source objects. An unauthenticated GraphQL client can alias fields to those names so responses from two subgraphs collide during ordinary supergraph result merging, causing mergeDeep to traverse Object and Function prototypes and overwrite Function.prototype.call with a subgraph-supplied value. This breaks subsequent requests in the process until restart.

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role to select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.

In Docling from 2.107.0 until 2.120.3, the OpenDocument backend uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting, allowing local files to be embedded in converted output.

In Docling from 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed.

In Docling from 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends accept rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can cause sustained CPU use or multi-gigabyte memory allocation.

In Docling from 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend does not reject picture image references containing local paths or file URIs. When the document is enriched or exported with ImageRefMode.EMBEDDED, DoclingDocument methods can open those references and place readable image bytes in Markdown or HTML output.

In Docling from 2.45.0 until 2.131.0, METS-GBS format detection and the backend call tarfile.TarFile.getmembers() before enforcing the max_member_count limit, causing the full archive member list to be allocated before the limit can stop processing. A small gzip-compressed tar archive with a very large number of empty members can consume memory proportional to the declared member count.

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class in docling/models/stages/ocr/kserve_v2_ocr_model.py sends page images to its configured endpoint without checking the pipeline_options.enable_remote_services setting, even when the caller sets that policy control to false. The StandardPdfPipeline._make_ocr_model method also fails to pass the flag into the OCR factory, allowing remote OCR processing in configurations that rely on remote services being disabled. The destination is configured by the caller rather than selected by an attacker.

In Docling from 2.27.0 until 2.131.0, plugin factories call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every module registered in the Docling entry-point group is imported even when external plugins are disabled. An installed malicious package can execute import-time code when Docling starts.

Docling from 2.94.0 until 2.132.0, when callers opt into LatexBackendOptions(tikz_engine="tectonic"), compiles an untrusted TikZ body and document preamble without restricting TeX file primitives including \openin and \openout. Crafted input can read files available to the converter and create or overwrite writable files, and enabling the tikz_engine_allow_shell_escape option additionally permits shell commands through TeX. The default configuration, which does not enable Tectonic rendering, is not affected.