vLLM versions from 0.20.0 up to but not including 0.30.0 contain a denial of service vulnerability. This flaw allows remote attackers to crash the inference engine by sending malformed multimodal metadata to the /inference/v1/generate endpoint. The issue arises from improper input validation, specifically when replaying valid multimodal items with repeated or overlapping placeholders or mismatched data lists, leading to a negative text span in Qwen2.5-VL position construction that terminates the engine.
vLLM versions from 0.10.2 up to but not including 0.25.0 have an uncontrolled resource consumption vulnerability. This flaw allows unauthenticated attackers to cause memory exhaustion by submitting specially crafted decompression-bomb images to the /v1/chat/completions endpoint. The vulnerability arises because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None, disabling limits on image size and enabling denial of service via out-of-memory conditions.
vLLM versions from 0.9.2 up to but not including 0.24.0 contain a server-side request forgery (SSRF) vulnerability. This flaw allows API callers to embed a decoded address in the X-Request-Id header, forcing the server to make outbound connections to attacker-controlled hosts. Exploitation can lead to leakage of NCCL unique_id and KV-cache tensors or cause denial of service by blocking worker processes.
vLLM versions from 0.19.0 up to but not including 0.24.0 contain a decompression bomb vulnerability in the AudioMediaIO multimodal path. Authenticated attackers can send small compressed audio inputs that decompress to very large PCM data, exhausting server memory and potentially causing denial of service.
vLLM versions from 0.22.0 up to but not including 0.24.0 have an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream services. This flaw allows attackers to submit out-of-vocabulary prompt token IDs, causing a fatal embedding lookup failure that terminates the EngineCore process and leaves the server in an unhealthy state.
vLLM versions from 0.22.0 up to but not including 0.24.0 contain a denial of service vulnerability. Remote attackers can exploit this by sending specially crafted Generate or GenerateStream requests with output_logprobs enabled and more than 128 output_candidates.token_ids. This triggers a fatal sampler exception in the Rust gRPC frontend, causing the EngineCore to crash and resulting in denial of service.
vLLM versions from 0.22.0 up to but not including 0.24.0 have an improper input validation vulnerability in the Rust gRPC converter. This flaw allows remote attackers to bypass max_logprobs limits by sending oversized or integer-wrapping top_n values in CandidateTokens.top_n. Exploiting this can cause torch.topk failures that terminate the EngineCore process.
SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to copy workspace conf files, including the API token and TLS private keys, into assets served to unauthenticated clients.
SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can send crafted UNION SELECT payloads to searchHistory or getHistoryItems endpoints to exfiltrate deleted document content, titles, and paths.
SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math block content rendered with KaTeX trust enabled. Attackers can store \href, \url, or \includegraphics payloads that mathRender assigns via innerHTML, executing script in the application origin when a reader clicks the rendered link.
SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into the workspace and read them back via /assets/ over HTTP.
SiYuan versions from 2.9.0 up to but not including 3.8.7 have a cross-site scripting (XSS) vulnerability in the unauthenticated /check-auth page. This vulnerability arises because the to parameter is assigned to window.location.href without validating the URI scheme. An attacker can craft a link with a javascript: URI that executes after the victim logs in, potentially allowing access to kernel APIs to read or modify workspace content and settings.
SiYuan versions 3.6.0 up to but not including 3.8.7 have a vulnerability where the networkServeTLS setting is accepted but not enforced. This causes the kernel port to serve the full API over plain HTTP alongside HTTPS, allowing network-adjacent attackers to sniff cleartext login credentials and session cookies. The session cookie lacks the Secure attribute and responses omit HSTS, increasing the risk of session hijacking.
Parse Server versions before 8.6.101 and versions from 9.0.0 up to but excluding 9.10.4-alpha.4 contain a missing authorization vulnerability affecting MongoDB deployments. This flaw allows unauthenticated attackers to send REST API delete requests to the internal _SCHEMA collection, enabling deletion of stored schema elements such as field definitions, class-level permissions, and protected fields. This unauthorized deletion can expose data to unauthorized reads and modifications.
CVE-2026-116164 is a vulnerability in parse-community's parse-server that affects versions before 8.6.100 and 9.0.0 before 9.10.4-alpha.3. It allows clients to write or clear reserved internal fields in objects due to improper input validation. This can cause read failures on MongoDB queries for all users or enable attackers to bypass account lockout and password policies by clearing their own lockout state and password history.
Parse Server versions before 8.6.102 and versions from 9.0.0 up to but excluding 9.10.5-alpha.2 contain an authentication bypass vulnerability. This occurs because certain validation methods in custom authentication adapters are never called, causing the system to use a default method that accepts any authentication data. Attackers can exploit this to sign up, link identities, log in as existing users, or bypass additional authentication factors without proper verification.
Parse Server versions before 8.6.104 and versions from 9.0.0 up to but not including 9.10.5-alpha.5 have an improper privilege management vulnerability. When issuing an SMS multi-factor authentication verification code, the server saves the entire login request with master privileges. This allows an SMS MFA-enrolled user to modify master-key-restricted fields on their own account, such as the email-verification flag or values protected by beforeSave triggers.
Parse Server versions before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 have an information disclosure vulnerability in the LiveQuery feature. The vulnerability arises because the subscription hash does not include constraints adjacent to a $or operator, such as the _Session owner filter and beforeSubscribe constraints. This causes distinct subscriptions to be grouped together, allowing authenticated clients using $or queries to receive events intended for other users, including session tokens that could be used for impersonation.
WWBN AVideo versions 26.0 through 29.3.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated commenters can inject JavaScript code via specially crafted comments that include an img tag with an onerror event handler. This occurs because the markDownToHTML() function preserves event-handler attributes in leading HTML blocks, bypassing the inline sanitizer. The injected script executes in the browsers of viewers under the application's origin.
A cross-site request forgery (CSRF) vulnerability exists in LinkStackOrg LinkStack versions 4.8.0 through 4.8.8. The flaw involves an unknown function that can be manipulated remotely without authentication, potentially allowing an attacker to perform unauthorized actions on behalf of a user. The vendor has not responded to disclosure attempts, and no patch or official fix is currently available.