Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
220 results · page 2 of 5
Aug 13, 2026vLLM is an inference and serving engine for large language models.CVE-2026-73559 · Other software · vllm-project · reported by GitHubMedium 6.5
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded list[str] or list[list[int]], prompt_to_seq() in vllm/renderers/inputs/preprocess.py and OnlineRenderer.preprocess_completion() in vllm/renderers/online_renderer.py expand every element, and vllm/entrypoints/openai/completion/serving.py creates one engine generator and response slot per prompt, allowing an authenticated API client to exhaust CPU, memory, async scheduling capacity, engine request slots, and response buffering with one request. This issue is fixed in version 0.26.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026vLLM is an inference and serving engine for large language models.CVE-2026-73558 · Other software · vllm-project · reported by GitHubMedium 5.3
vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or complete copy of another user's inference result. This issue is fixed in version 0.27.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026vLLM is an inference and serving engine for large language models.CVE-2026-73557 · Other software · vllm-project · reported by GitHubMedium 6.3
vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse.check_sparse_tensor_invariants, whose process-global save, enable, and restore state can be raced by concurrent prompt_embeds parts submitted to POST /v1/chat/completions through AsyncMultiModalItemTracker.resolve_items, asyncio.gather, and the default executor, allowing an invalid sparse tensor to reach tensor.to_dense despite the CVE-2025-62164 guard when enable_prompt_embeds is enabled. This issue is fixed in version 0.26.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026vLLM is an inference and serving engine for large language models.CVE-2026-73556 · Other software · vllm-project · reported by GitHubMedium 5.3
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compile_regex_with_timeout or validation in validate_structured_output_request_lm_format_enforcer, allowing an unauthenticated /v1/completions request against the lm-format-enforcer backend to consume a CPU core and stall the structured-output engine path with a catastrophic regular expression. This issue is fixed in version 0.26.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026vLLM is an inference and serving engine for large language models.CVE-2026-73555 · Other software · vllm-project · reported by GitHubMedium 5.3
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_message in vllm/entrypoints/utils.py does not remove traceback-style file paths, allowing unauthenticated malformed JSON requests to /v1/chat/completions, /v1/completions, /tokenize, and /detokenize to disclose the OS username, home and virtual-environment paths, Python version, internal package structure, line numbers, and endpoint handler names. This issue is fixed in version 0.26.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Uncontrolled search path for some Approximate Bayesian Inference Framework before version on commit #484c949 within Ring 3: User Applications may allow an escalCVE-2026-32788 · Other software · Intel · reported by secure@intel.comMedium 5.4
Uncontrolled search path for some Approximate Bayesian Inference Framework before version on commit #484c949 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
- Product
- Approximate Bayesian Inference Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modifieCVE-2026-47487 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 4.4
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of service and information disclosure.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Jul 23, 2026SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticateCVE-2026-65701 · Other software · svc-develop-team · reported by VulnCheckCritical 9.3
SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesystem paths through the audio_path field of an unauthenticated POST request to the /wav2wav route. Attackers can pass arbitrary server-side paths verbatim to librosa.load, torchaudio.load, and soundfile.write sinks, causing the server to decode and return file contents via the HTTP response body while also writing attacker-specified .wav files to arbitrary locations on the filesystem.
- Product
- so-vits-svc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 16, 2026text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compatible multimodal chat completions endpoinCVE-2026-63086 · Other software · huggingface · reported by VulnCheckMedium 6.9
text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compatible multimodal chat completions endpoint that allows unauthenticated network attackers to coerce the server into issuing arbitrary HTTP GET requests by supplying a crafted image_url value in chat message content. The fetch_image function in router/src/validation.rs performs no validation of private, loopback, link-local, or cloud metadata target addresses, and the reqwest HTTP client follows redirects by default, enabling attackers to bypass scheme checks via redirect chains to reach internal services and cloud instance-metadata endpoints for internal port scanning and credential theft.
- Product
- text-generation-inference
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 15, 2026ncnn is a high-performance neural network inference framework optimized for the mobile platform.CVE-2026-50144 · Other software · Tencent · reported by GitHubHigh 7.1
ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::load_param() when Net::load_param() loads a malicious .param model file because the parsed parameter id is checked only against id >= NCNN_MAX_PARAM_COUNT, allowing a negative id to index before the params[NCNN_MAX_PARAM_COUNT] array. This vulnerability is fixed by commit 5a0288f255daa6c3294f77109f67718e434ec020.
- Product
- ncnn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API where an attacker could trigger a reachable assertion in the sampler thread.CVE-2026-47475 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.2
NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API where an attacker could trigger a reachable assertion in the sampler thread. A successful exploit of this vulnerability might lead to denial of service.
- Product
- TensorRT-LLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause allocation of GPU resources without limits orCVE-2026-24271 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.2
NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause allocation of GPU resources without limits or throttling. A successful exploit of this vulnerability might lead to denial of service.
- Product
- TensorRT-LLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory after effective lifetime.CVE-2026-47482 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory after effective lifetime. A successful exploit of this vulnerability might lead to denial of service.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel.CVE-2026-47481 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.5
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an uncaught exception.CVE-2026-47480 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an uncaught exception. A successful exploit of this vulnerability might lead to denial of service.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption.CVE-2026-47479 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the use of an expired file descriptor.CVE-2026-47478 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the use of an expired file descriptor. A successful exploit of this vulnerability might lead to denial of service.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a stack-based buffer overflow.CVE-2026-47477 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to denial of service.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption.CVE-2026-47476 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication.CVE-2026-56669 · Other software · elysiajs · reported by GitHubHigh 7.5
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.
- Product
- elysia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 6, 2026vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs.CVE-2026-55574 · Other software · vllm-project · reported by GitHubHigh 8.7
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user-supplied regular expression string directly to the grammar compiler backends with no compilation timeout; in the xgrammar backend the string reaches the regex compiler with no guard, and in the outlines backend the validation step blocks structural issues such as lookarounds and backreferences but performs no complexity analysis, so a pattern with nested quantifiers passes all checks and causes exponential state-space expansion, allowing a single request containing an adversarial regex to hang an inference worker indefinitely and deny service. This issue is fixed in version 0.24.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026vLLM is a library for LLM inference and serving.CVE-2026-55514 · Other software · vllm-project · reported by GitHubHigh 7.1
vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a /v1/completions request with a model using M-RoPE causes EngineCore to fail an assertion and fatally crash, shutting down the entire server application. Any remote user who is authorized to make a /v1/completions request can make such a request and induce a crash. This issue is fixed in version 0.24.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs.CVE-2026-54234 · Other software · vllm-project · reported by GitHubHigh 7.5
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into the drafter's input ids; that out-of-vocabulary value is later consumed by the model's embedding and attention path and crashes the engine worker with a GPU device-side assertion. The same triggering request sequence is reachable through the public gRPC Generate and Abort endpoints, so a remote client that can send generation requests can crash the shared engine worker, aborting concurrent requests and causing a service-wide denial of service for other clients of the deployment until the worker is restarted. This issue is fixed in version 0.24.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026vLLM is an inference and serving engine for large language models.CVE-2026-55646 · Other software · vllm-project · reported by GitHubMedium 6.5
vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/translations routes call request.file.read() to fully materialize an uploaded audio file into memory before vLLM checks the documented VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed upload size limit (default 25 MB) later in the speech-to-text preprocessing step, so an API caller who can reach those routes can submit an oversized multipart upload and cause vLLM to allocate memory proportional to the uploaded file size before the request is rejected as too large, creating memory pressure or terminating the process depending on deployment resource limits. This issue is fixed in version 0.24.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use-after-free issue.CVE-2026-24266 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.9
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use-after-free issue. A successful exploit of this vulnerability might lead to denial of service.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Jul 1, 2026NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data.CVE-2026-24264 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data. A successful exploit of this vulnerability might lead to denial of service.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Jun 22, 2026vLLM is an inference and serving engine for large language models (LLMs).CVE-2026-54236 · Other software · vllm-project · reported by GitHubMedium 5.3
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message helper that strips object-repr memory addresses from error messages before they reach the client, is incomplete: several response paths echo str(exc) directly to clients without calling sanitize_message. The unsanitized sites include the Anthropic API router in vllm/entrypoints/anthropic/api_router.py (the POST /v1/messages and POST /v1/messages/count_tokens handlers), the Server-Sent Events streaming converter in vllm/entrypoints/anthropic/serving.py, and the realtime speech-to-text WebSocket in vllm/entrypoints/speech_to_text/realtime/connection.py. These paths catch the exception inside the route coroutine and construct the JSONResponse themselves, bypassing the sanitizing global FastAPI exception handler, and WebSocket frames do not traverse that handler chain at all. Using the same primitive as the parent issue, an unauthenticated attacker can send malformed image bytes through the Anthropic Messages API image content parts so that PIL.Image.open raises an UnidentifiedImageError whose message contains the BytesIO object r
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026vLLM is an inference and serving engine for large language models (LLMs).CVE-2026-54235 · Other software · vllm-project · reported by GitHubMedium 6.9
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (<, >), which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagate to GPU sampling kernels, where they produce undefined behavior or CUDA errors that can crash the inference worker. This vulnerability is fixed in 0.23.1rc0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026vLLM is an inference and serving engine for large language models (LLMs).CVE-2026-54233 · Other software · vllm-project · reported by GitHubMedium 6.5
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, vLLM's /v1/audio/transcriptions endpoint limits compressed upload size but not decoded PCM output. A 25MB OPUS file expands to ~14.9GB of float32 PCM at decode time. This vulnerability is fixed in 0.23.1rc0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026vLLM is an inference and serving engine for large language models (LLMs).CVE-2026-54232 · Other software · vllm-project · reported by GitHubHigh 8.8
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UV_INDEX_STRATEGY="unsafe-best-match" is set globally. An attacker who registers flashinfer-jit-cache on PyPI with version 0.6.11.post2 can execute arbitrary code as root during the Docker build and backdoor every resulting container image, enabling exfiltration of all user prompts, API credentials, and model data from production vLLM deployments This vulnerability is fixed in 0.22.1.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026vLLM is an inference and serving engine for large language models (LLMs).CVE-2026-53923 · Other software · vllm-project · reported by GitHubMedium 5.3
vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0, integer truncation of tensor dimensions in vLLM's GGUF dequantize kernels (csrc/quantization/gguf/gguf_kernel.cu) causes partial tensor processing. The output tensor is allocated at full size via torch::empty (uninitialized memory), but the dequantize CUDA kernel processes only a truncated number of elements. The unfilled portion of the output tensor retains whatever was previously in GPU memory. In multi-tenant inference deployments, this residual GPU memory may contain tensor data from other users' inference requests, constituting information disclosure. This vulnerability is fixed in 0.23.1rc0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026vLLM is an inference and serving engine for large language models (LLMs).CVE-2026-48746 · Other software · vllm-project · reported by GitHubCritical 9.1
vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026vLLM is an inference and serving engine for large language models (LLMs).CVE-2026-47155 · Other software · vllm-project · reported by GitHubMedium 6.5
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM's revision pinning controls do not consistently apply to all artifacts loaded for a model. A deployment that supplies --revision or --code-revision can still load dynamic code, GGUF files, image processors, retrieval side weights, or same-repository subfolder weights/config from an unpinned/default revision. This is a supply-chain integrity issue for pinned vLLM deployments. Operators can believe they are serving a reviewed model revision while vLLM resolves behavior-affecting nested or sibling artifacts outside that reviewed revision. This vulnerability is fixed in 0.22.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026vLLM is an inference and serving engine for large language models (LLMs).CVE-2026-41523 · Other software · vllm-project · reported by GitHubHigh 7.5
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-infCVE-2026-53805 · Other software · nv-tlabs · reported by VulnCheckCritical 9.3
NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads() without authentication or input validation. Attackers can supply a crafted payload containing a __reduce__ gadget to the inference API port to achieve remote code execution as the inference process.
- Product
- GEN3C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026A flaw was found in vLLM, an open-source library for large language model inference.CVE-2026-12491 · Other software · vllm-project · reported by Red HatMedium 4.8
A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing. When images are converted to RGB, transparency information may be implicitly discarded or remapped, leading to unexpected rendering of transparent pixels and distortion of input content. This can result in the model misinterpreting image content, potentially affecting the integrity of processed data.
- Product
- vLLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jun 16, 2026stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference.CVE-2026-47750 · Other software · leejet · reported by GitHubHigh 7.8
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. In versions prior to master-584-0a7ae07, the pickle .ckpt parser in src/model.cpp contained a heap buffer overflow vulnerability in the GLOBAL opcode handler. The issue was caused by missing validation when searching for newline-delimited fields. A crafted .ckpt file without the expected newline could cause the parser to use -1 as a copy length, resulting in immediate heap corruption. The attack requires the victim or application to load a .ckpt file from an untrusted source, such as a downloaded model from a model sharing site. The issue has been resolved in version master-584-0a7ae07. If developers are unable to immediately update their applications they can work around this issue by following these instructions: do not load .ckpt checkpoint files from untrusted sources, and prefer trusted model sources and safer formats such as .safetensors where possible.
- Product
- stable-diffusion.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference.CVE-2026-47747 · Other software · leejet · reported by GitHubHigh 7.8
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. In versions prior to master-584-0a7ae07, the pickle .ckpt parser in src/model.cpp contained a heap buffer overflow vulnerability in the BINUNICODE opcode handler. The issue was caused by sign confusion on the opcode length field. A crafted .ckpt file could trigger memcpy with a very large length derived from a negative signed value, causing immediate heap corruption. The issue has been resolved in version master-584-0a7ae07. If developers are unable to immediately update their applications they can work around this issue by only loading .ckpt checkpoint files from trusted sources and preferring trusted model sources and safer formats such as .safetensors where possible.
- Product
- stable-diffusion.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference.CVE-2026-47749 · Other software · leejet · reported by GitHubHigh 7.8
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior to master-584-0a7ae07 are vulnerable to heap buffer overflow in SHORT_BINUNICODE parsing for PyTorch checkpoint files. The pickle .ckpt parser in src/model.cpp contained a heap buffer overflow vulnerability in the SHORT_BINUNICODE opcode handler. The issue was caused by sign confusion on the opcode length field. A crafted .ckpt file could trigger memcpy with a very large length derived from a negative signed value, causing immediate heap corruption. Any application using affected stable-diffusion.cpp releases to load untrusted .ckpt model files could be vulnerable. A malicious checkpoint file could cause heap corruption through memcpy with an attacker-controlled length. This may lead to process crash and could potentially be leveraged for code execution depending on heap layout. The attack requires the victim or application to load a .ckpt file from an untrusted source, such as a downloaded model from a model sharing site. The issue has been resolved in version master-584-0a7ae07. If developers are unable to immediately upda
- Product
- stable-diffusion.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference.CVE-2026-47748 · Other software · leejet · reported by GitHubMedium 5.5
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior to master-584-0a7ae07 are vulnerable to an out-of-bounds reads error through PyTorch checkpoint pickle opcode parsing. The pickle .ckpt parser in src/model.cpp did not consistently check that enough input remained before reading opcode arguments or advancing the parser buffer with a crafted or truncated .ckpt file. Throughout the pickle parser, opcode handlers advanced the parser position with expressions such as buffer += N without first checking that buffer + N <= buffer_end. A truncated file could therefore cause reads past the end of the metadata buffer. LibFuzzer found crashes in under one second using malformed checkpoint inputs. Any application using affected stable-diffusion.cpp releases to load untrusted .ckpt model files could be vulnerable. The attack requires the victim or application to load a .ckpt file from an untrusted source, such as a downloaded model from a model sharing site. This issue has been fixed in version master-584-0a7ae07. If developers are unable to immediately update their applications, they ca
- Product
- stable-diffusion.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2026-44346 · Other software · bentoml · reported by GitHubHigh 8.8
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs[*].name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentoml containerize on the imported bento, those RUN directives execute on the host during docker build. This vulnerability is fixed in 1.4.39.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2026-44345 · Other software · bentoml · reported by GitHubHigh 8.8
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/_internal/container/frontend/dockerfile/templates/base_v2.j2 interpolates docker.base_image raw with no escaping, newline filtering, or validation. A malicious bento.yaml with a multi-line docker.base_image value smuggles arbitrary Dockerfile directives into the generated Dockerfile, and bentoml containerize then runs docker build which executes the injected RUN directives on the victim host. This vulnerability is fixed in 1.4.39.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model CVE-2026-5843 · Other software · Docker · reported by security@docker.comHigh 8.8
The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the model_file configuration field in config.json. When a model's config.json specifies a model_file pointing to a Python file, MLX-LM uses importlib to load and execute it with no trust_remote_code gate or equivalent safety check. The MLX backend runs without sandboxing, resulting in arbitrary code execution on the Docker host as the Docker Desktop user. Any container on the Docker network can trigger this by calling the model-runner.docker.internal API to pull a malicious model from an attacker-controlled OCI registry and request inference.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sanCVE-2026-5817 · Other software · Docker · reported by security@docker.comHigh 8.8
The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sandboxing. This causes transformers.AutoTokenizer.from_pretrained() to import and execute arbitrary Python files included in any model pulled from an OCI registry, resulting in arbitrary code execution on the Docker host as the Docker Desktop user when inference is triggered. Any container on the Docker network can trigger this by calling the model-runner.docker.internal API to pull a malicious model and request inference.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2026-40610 · Other software · bentoml · reported by GitHubMedium 5.5
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.38 and prior, the build packaging workflow follows attacker-controlled symlinks inside the build context and copies the referenced file contents into the generated Bento artifact. If a victim builds an untrusted repository or other attacker-supplied build context, the attacker can place a symlink such as loot.txt -> /tmp/outside-marker.txt or a link to a more sensitive local file. When bentoml build runs, BentoML dereferences the symlink and packages the target file contents into the Bento. The leaked file can then propagate further through export, push, or containerization workflows. An attacker can exfiltrate local files from the build host into the Bento artifact, exposing secrets such as cloud credentials, SSH keys, API tokens, environment files, or other sensitive local configurations. Because Bento artifacts are commonly exported, uploaded, stored, or containerized after build, the leaked file contents can spread beyond the original build machine. This issue has been fixed in version 1.4.39.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026NVIDIA Triton Inference Server contains a vulnerability in the DALI backend, where an attacker could cause uncontrolled resource consumption.CVE-2026-24215 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.7
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend, where an attacker could cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
May 20, 2026NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integer overflow.CVE-2026-24214 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integer overflow. A successful exploit of this vulnerability might lead to code execution, data tampering, or denial of service.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
May 20, 2026NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-of-bounds read.CVE-2026-24213 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, or information disclosure.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
May 20, 2026NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an integer overflow.CVE-2026-24210 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an integer overflow. A successful exploit of this vulnerability might lead to denial of service.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
May 20, 2026NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue.CVE-2026-24209 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vulnerability might lead to denial of service.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.