Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-114055 | high | 7.5 | No | vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal p... | 2026-11-03 |
| CVE-2026-114052 | high | 7.5 | No | vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every... | 2026-11-03 |
| CVE-2026-114050 | high | 7.5 | No | vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engin... | 2026-11-03 |
| CVE-2026-114053 | high | 8.1 | No | vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained,... | 2026-11-03 |
| CVE-2026-114049 | low | 3.7 | No | vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outp... | 2026-11-03 |
| CVE-2026-114051 | high | 7.5 | No | vLLM before 0.31.0 skips the min_tokens | 2026-11-03 |
| CVE-2026-114054 | medium | 6.5 | No | vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying cal... | 2026-11-03 |
| CVE-2026-116159 | low | 3.3 | No | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where... | 2026-11-03 |
| CVE-2026-116157 | low | 3.3 | No | ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image propert... | 2026-11-03 |
| CVE-2026-116156 | low | 3.3 | No | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used... | 2026-11-03 |
| CVE-2026-116155 | medium | 5.3 | No | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers c... | 2026-11-03 |
| CVE-2026-116154 | medium | 5.3 | No | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released... | 2026-11-03 |
| CVE-2026-116142 | low | 3.3 | No | ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printi... | 2026-11-03 |
| CVE-2026-116141 | medium | 5.3 | No | ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height... | 2026-11-03 |
| CVE-2026-116145 | low | 3.9 | No | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the policy bypass rep... | 2026-11-03 |
| CVE-2026-12944 | critical | 9.6 | No | IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow serv... | 2026-11-03 |
| CVE-2026-12767 | medium | 6.5 | No | IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to sen... | 2026-11-03 |
| CVE-2026-12766 | medium | 5.4 | No | IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send... | 2026-11-03 |
| CVE-2026-116149 | high | 8.1 | No | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Atta... | 2026-11-03 |
| CVE-2026-12765 | medium | 6.5 | No | IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to sen... | 2026-11-03 |