Tag
vLLM: Uncontrolled resource consumption via image processing (CVE-2026-116177)
1 TTP 4 CVEsAn unauthenticated denial of service vulnerability in vLLM versions 0.10.2 through 0.24.x allows attackers to trigger an out-of-memory condition by submitting decompression-bomb images to the /v1/chat/completions endpoint.
LoopX serve-status CORS Misconfiguration and Information Disclosure
1 TTP 1 CVELoopX serve-status (v0.0.1 to v0.4.4) uses a permissive wildcard CORS policy on unauthenticated local HTTP endpoints, allowing any website to exfiltrate private control-plane state and markdown documentation from local developer environments.
Information Disclosure in SiYuan Kernel Enabling Offline Password Cracking
4 rules 8 TTPs 1 CVEAn information disclosure vulnerability in SiYuan's API allows unauthorized remote readers to retrieve cryptographic material necessary for offline, unthrottled GPU-based cracking of encrypted notebook master passwords.
Remote Code Execution in GitPython via Git Config Injection
4 TTPs 1 CVEGitPython versions before 3.1.59 contain a vulnerability where improper sanitization of multi-line configuration values allows attackers to inject arbitrary git directives, leading to remote code execution.
Arbitrary XML Schema Definition Processing in guardrails-detectors Leads to SSRF and Local File Read
3 TTPs 1 CVEA flaw in the 'file_type' content detector of 'guardrails-detectors' allows a remote attacker to provide an arbitrary XML Schema Definition (XSD) string, leading to server-side request forgery (SSRF) and local file reads, potentially exposing sensitive information such as cloud provider credentials or granting access to internal network services.
Multiple Vulnerabilities Discovered in Wireshark Leading to DoS and Data Confidentiality Compromise
2 TTPs 5 CVEsMultiple vulnerabilities (CVE-2026-15163 through CVE-2026-15174) have been discovered in Wireshark, impacting versions 4.6.x prior to 4.6.7 and versions prior to 4.4.17, which could allow a remote attacker to cause a denial of service and compromise data confidentiality.
WordPress Easy PayPal Events & Tickets Plugin Information Disclosure Vulnerability
2 rules 1 TTP 1 CVEAn information disclosure vulnerability in the Easy PayPal Events & Tickets WordPress plugin (versions 1.3 and earlier) allows unauthenticated attackers to enumerate and retrieve all customer order records via the scan_qr.php endpoint.