CVE Vulnerability Catalog

A vulnerability in vLLM from version 0.7.0 to before 0.19.0 allows an attacker to send a single API request with thousands of base64-encoded JPEG frames, causing the server to decode all frames into memory and crash with OOM. The issue is due to missing frame count limit in the VideoMediaIO.load_base64() method.

In OpenEXR versions 3.2.0 to 3.2.7, 3.3.9, and 3.4.9, a vulnerability exists in the DWA lossy decoder. For sufficiently large image widths, 32-bit arithmetic overflow causes writes outside the allocated rowBlock buffer.

A memory corruption vulnerability occurs when accessing freed memory due to concurrent fence deregistration and signal handling. The race condition leads to a use-after-free scenario.

A stored cross-site scripting (XSS) vulnerability in Bynder before 12 January 2026 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

SQL Injection vulnerability in PHPGurukul Online Shopping Portal Project 2.1. Unknown part of /cancelorder.php in Parameter Handler allows manipulation of oid argument, leading to SQL injection. Remote attack possible. Exploit published.

SQL Injection vulnerability in PHPGurukul Online Shopping Portal Project 2.1. Unknown functionality in /categorywise-products.php in Parameter Handler allows manipulation of cid argument, leading to SQL injection. Remote attack possible. Exploit published.

Fix in the Linux kernel for ksmbd: uses volume UUID in FS_OBJECT_ID_INFORMATION. For filesystems without UUID, falls back to stfs.f_fsid from vfs_statfs().

A cross-site scripting vulnerability has been found in assafelovic gpt-researcher up to version 3.4.3 in the Report API component in file backend/server/app.py.

gpt-researcher up to 3.4.3 has an XSS vulnerability in the WebSocket interface via the 'task' argument in researcher.php. Remote exploitation is possible and the exploit is public.

Cross-Site Request Forgery (CSRF) vulnerability in ProjectSend r2002 in upload.php. The attack can be performed remotely. An exploit is publicly available.

Huly Platform (hcengineering) version 0.7.382 has a server-side request forgery vulnerability in the Import endpoint at server/front/src/index.ts. The attack can be launched remotely, and the exploit is publicly available.

A vulnerability in ChrisChinchilla Vale-MCP up to version 0.1.0 allows OS command injection via the config_path argument in the HTTP Interface component. Local access is required and the exploit is publicly available.

SQL Injection vulnerability in Construction Management System 1.0. An unknown function in the file /borrowed_equip_report.php allows manipulation of the Home argument, leading to SQL injection. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability in Braffolk mcp-summarization-functions up to version 0.1.5 allows OS command injection via the command argument in the summarize_command component. Local access is required and the exploit is publicly available.

In kodbox up to version 1.64, a Server-Side Request Forgery (SSRF) vulnerability exists in the shareMake/shareCheck component. Manipulating the siteFrom/siteTo arguments allows server-side requests. The attack is remote but difficult. The exploit is public. The vendor did not respond.

The givanz Vvvebjs tool up to version 2.0.5 has a cross-site scripting vulnerability in upload.php (File Upload Endpoint) via the uploadAllowExtensions argument. Remote exploitation is possible, and the exploit is publicly available.

In imprvhub mcp-browser-agent up to version 0.8.0, a server-side request forgery (SSRF) vulnerability exists in the CallToolRequestSchema function of src/handlers.ts. Manipulation of request.params.name and request.params.arguments leads to SSRF. Remote exploitation is possible and the exploit is public.

PHPGurukul Online Shopping Portal Project 2.1 is vulnerable to SQL injection via the 'orderid' parameter in the file /order-details.php. An attacker can remotely manipulate this parameter, leading to unauthorized SQL queries.

The elgentos magento2-dev-mcp tool up to version 1.0.2 has an OS command injection vulnerability in the executeMagerun2Command function in src/index.ts. The exploit is publicly available.

The Nor2-io heim-mcp tool up to version 0.1.3 has an OS command injection vulnerability in the registerTools function in src/tools.ts (component new_heim_application/deploy_heim_application/deploy_heim_application_to_cloud). The exploit is publicly available.