Advisory Catalog

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing

vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow

devalue: `stringify`/`uneval` serialize shared memory

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

deepmerge mergeObject() allows prototype poisoning of returned objects

source-map-js allows event-loop denial of service through indexed source-map section offsets

Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses

Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

md-editor-v3: XSS via fenced-code language rendering bypass

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

AnyIO process-pool workers can block indefinitely on undrained stderr

adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

LMDeploy has an SSRF bypass

LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks

Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)

Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)

Semantic MediaWiki has an open redirect in Special:URIResolver

Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes