Advisory Catalog

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values

Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kserve_v2_ocr_model.py sends page images to its configured endpoint without checki

Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

Docling: Configured HTTP headers sent to every remote image host named by a document

Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Ghost: Authorization Bypass in Comments Feature

Ghost: Authorization Issue Allowed Author Role to Delete any Post

Ghost: Editors Could Promote Staff Users to Their Own Role

Ghost: Path Traversal via Locale Setting

Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Ghost: Server-Side Request Forgery in Bookmark Fetching

Ghost: Regular Expression Denial of Service in Content Import

Ghost: Regular Expression Denial of Service in External Media Inliner

Ghost : Stored XSS via SVG Files in Content Imports

Ahsay AhsayCBS Improper Authentication Vulnerability

Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

Trigger.dev: Cross-environment deployment cancel

Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

Trigger.dev: Blind SSRF via alert-channel webhook

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

@orpc/zod: Prototype injection in smart coercion

Nx: Path traversal in nx migrate package-migrations extraction

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

uv: Path traversal on Windows through wheel extraction

stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

Filament: Multi-factor authentication (app) management actions do not require password reauthentication

geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

devalue: Residual sparse-array CPU amplification in uneval

next.js cache leak across root param values in nested 'use cache' functions

devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse