Browse All

vLLM (a framework for running large language models) versions up to 0.29.0 has a bug where it doesn't properly check if token indices (numerical identifiers for words) are within valid bounds when processing bad words filters. An attacker can exploit this by providing invalid token indices that corrupt the memory used for generating tokens (logits, which are scores the model assigns to possible next words), causing different user requests being handled at the same time to get wrong results.

vLLM (a software framework for running large language models) versions up to 0.29.0 have a memory corruption vulnerability (a bug where data in memory gets overwritten incorrectly) in a component called Triton _bincount_kernel. Attackers can send audio requests with specially crafted token IDs (numeric identifiers for words or sounds) that exceed the vocabulary size (the total number of valid tokens the system knows), causing the system to write data outside its intended memory area and breaking how other requests handle repetition penalties (the mechanism that prevents the AI from repeating the same words too often).

vLLM (a library for running large language models) versions before 0.29.0 have a bug in how it checks allowed token IDs (specific outputs the model is restricted to producing). The code incorrectly checks these IDs against the tokenizer length (the number of tokens the input processor knows about) instead of the model's output vocabulary width (the actual number of different tokens the model can generate). An attacker can exploit this by providing token IDs that pass the faulty check but are actually invalid, corrupting the GPU's internal state and allowing other simultaneous requests to break out of their output restrictions.

OpenTelemetry-Go versions 1.5.0 through 1.44.0 can accidentally leak trace exporter endpoint URLs and configuration details in internal diagnostic logs when an application enables verbose logging. The vulnerability only affects apps that explicitly configure a verbose logger and use exporters like Zipkin with credentials embedded in URLs, potentially exposing collector addresses, network topology, and embedded credentials to anyone with access to those logs.

Grav CMS has a security flaw in how it checks whether a web request's Referer header (the page the user came from) belongs to the same website. The code uses `str_starts_with()` to compare the Referer against the site's root URL, but without checking for a boundary character (like a slash) after the match. This allows an attacker to register a domain like `example.com.attacker.tld` that starts with the victim's domain name and bypass the origin validation check, potentially leading to unauthorized actions.

Microsoft is investigating a bug where Copilot buttons disappear in Classic Outlook for Windows users with Copilot Chat (Basic) or paid M365 Copilot (Premium) licenses, particularly after updating to build 20026.20182 and higher. The issue stems from Outlook being unable to locate a specific MAPI property (a data structure that stores email settings) needed to display the Copilot feature in the navigation pane. Copilot remains accessible through other entry points like Outlook on the web or the Microsoft 365 Copilot standalone app.

A vulnerability exists in Oracle Coherence version 15.1.1.0.0, a data management product in Oracle Fusion Middleware. An attacker with low-level access to the computer where Coherence runs could exploit this difficult-to-execute flaw to read some data they shouldn't be able to access, though the risk is rated as low (CVSS score, a 0-10 rating of how severe a vulnerability is: 2.5).

Oracle Coherence, a data management product in Oracle Fusion Middleware, has a vulnerability (CVE-2026-83413) that allows attackers with high-level access to the system where it runs to modify or delete some stored data without permission. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, but is difficult to exploit and has a low severity score (CVSS 3.1 score of 1.9, a metric from 0-10 that rates how serious a flaw is).

A security vulnerability (CVE-2026-90713) exists in vLLM (an open-source large language model serving framework) versions up to 0.29.0 in the TiktokenTokenizer function that handles vocabulary files. An attacker with local access to the system can exploit this flaw to cause a denial of service (making the service unavailable), and the exploit code has been publicly released.

A security flaw (CVE-2026-85704) was found in the freegpt-webui project's Jailbreak Mode feature, affecting a function called getJailbreak in the server/config.py file. The flaw creates a race condition (a bug where the timing of operations causes unexpected behavior), which can be exploited remotely, though it requires significant technical skill to carry out. The vulnerability affects an older version of the product that is no longer maintained.

The MasterStudy LMS WordPress Plugin before version 3.7.46 has a security flaw where it doesn't properly check whether an instructor owns a curriculum (course structure) before letting them change it. This means an instructor can delete or modify course materials belonging to other instructors' courses.

The MasterStudy LMS WordPress Plugin (a learning management system add-on for WordPress) before version 3.7.46 has a security flaw where it doesn't properly check if an instructor owns a quiz question before letting them view it. This means an instructor can read other instructors' quiz questions, including the answers and explanations, which they shouldn't be able to access.

LLM version 0.32.1 broke on fresh installs because the OpenAI Python library stopped using httpx (a library for making web requests), and LLM was relying on httpx being installed indirectly through that dependency. This version fixes the problem by restricting which OpenAI versions can be used, with a plan to fully switch to a different library in the next release.

ONNX (Open Neural Network Exchange, a standard format for sharing machine learning models) versions 1.3.0 through 1.22.0 have a bug where converting models to an older format can crash if certain input data doesn't have enough dimensions, because the code tries to read array positions that don't exist without checking first.

Google's Pet Memory feature for Gemini for Home is designed to help smart home systems recognize and remember specific pets by learning which animals belong to a household, allowing connected security cameras to identify individual pets rather than just detecting generic animals. The feature aims to reduce notification overload from cameras and enable the smart home to adapt its behavior based on which pet is detected. However, according to the article title, the feature has a problem: it forgets which cats belong to the user.

A path traversal vulnerability (CWE-22, a flaw where an attacker can access files outside a restricted directory) was found in PV-Bhat gemsuite-mcp version 1.0.0, specifically in a file handling component that processes file_path arguments. An attacker with local access to the system could exploit this to access unauthorized files, though the project developers have not yet responded to the initial report.

The `create_dynatrace_notebook` tool in @dynatrace-oss/dynatrace-mcp-server is missing a human-approval gate that should require operator consent before executing. Unlike five other write tools in the same library, this tool allows anyone to create persistent notebooks with arbitrary content (including embedded DQL queries that execute under other users' permissions) without any confirmation from the system operator.

Open WebUI had a caching bug in its model-list endpoints where the `@cached` decorator used `key=` instead of `key_builder=`, causing all users to share a single cache entry instead of each having their own permission-filtered list. This meant one user could briefly see another user's accessible models if they made a request within the 1-second cache window after that user.

Open WebUI's Socket.IO server accepts unauthenticated WebSocket connections and has two collaborative document handlers (`ydoc:awareness:update` and `ydoc:document:leave`) that lack authentication checks. This allows an attacker without login credentials to spoof user presence, fake cursor positions, and broadcast false events to legitimate users editing documents together.

A vulnerability in the Ansible Lightspeed extension for Visual Studio Code allows attackers with access to a user's computer or malware running on it to steal the Google Gemini API key (a credential that grants access to AI services). The extension stores this key in plain text (unencrypted, readable format) in the user's configuration file and writes it to log files, potentially letting attackers use the user's API quota.