Advisory Catalog

F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

Check Point Multiple Products Path Traversal Vulnerability

Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 480

vllm p2p never connected zmq_exhaustion

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in NixlBas

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kv_transfer_params dictionary entries to trigger an uncaught KeyError in EngineCore scheduling, c

Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory

Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509

deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes