Sårbarhetsdatabas
Sårbarhetsinformation i realtid från EU:s sårbarhetsdatabas (EUVD).
Realtidsåtkomst till EU:s sårbarhetsdatabas (EUVD), som underhålls av ENISA. Sök och övervaka CVE:er (Common Vulnerabilities and Exposures), utnyttjade sårbarheter och kritiska säkerhetsbrister som påverkar mjukvaruprodukter världen över.
- Senaste: Senast avslöjade sårbarheter över alla mjukvaruleverantörer och produkter.
- Utnyttjade: Sårbarheter bekräftade att aktivt utnyttjas — prioritera patchning omedelbart.
- Kritiska: Sårbarheter med KRITISK svårighetsgrad (CVSS 9.0+) som kräver omedelbar uppmärksamhet.
- Sök: Sök efter produktnamn, leverantör, CVSS-poängintervall eller utnyttjandestatus.
Varje sårbarhet inkluderar CVSS-poäng, EPSS-sannolikhet för utnyttjande, berörda leverantörer och produkter, referenser till rådgivningar och CVE-alias. Klicka på en sårbarhet för att se fullständiga detaljer.
Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to the requested application and tenant. An authenticated workspace member could therefore change another application's MCP server status and parameters, potentially redirecting data or disabling the service. This issue is fixed in version 1.16.0.
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options without a strict work ceiling. GLMGA constructs and deduplicates an attacker-sized pre-decode frame-index list, allowing a compact request and tiny valid video to consume disproportionate CPU time and memory in the shared media-loading executor. This issue is fixed in version 0.30.0.
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus's Family::get_or_create function to permanently create counter and histogram label sets. Those label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted. This issue is fixed in version 0.30.0.
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
Snowflake drivers writes sensitive information to logs
vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs.video.fps fields without enforcing server-side ceilings. An unauthenticated caller can submit these values to the /tokenize endpoint, causing the sampler to decode every frame selected from attacker-controlled video input, consume disproportionate frontend memory, and potentially terminate the API process before scheduling or admission control. The Rust frontend is not affected because it rejects the media_io_kwargs field. This issue is fixed in version 0.30.0.
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows