Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 60

Export CSV
CVE-2026-48710

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

CVSS 3.1 · 6.5 Medium EPSS 70.3% KEV · Listed
Vendors
Encode Kludex Redhat
Products
Starlette Starlette Ai Inference Server and 6 more
CVE-2026-18393

Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursor

A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg Red Hat Redhat
Products
Ffmpeg Red Hat Openshift Ai (rhoai) Enterprise Linux Ai and 1 more
CVE-2026-12706

Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move()

A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg Redhat
Products
Ffmpeg Enterprise Linux Enterprise Linux Ai and 1 more
CVE-2026-12491

Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations

A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing. When images are converted to RGB, transparency information may be implicitly discarded or remapped, leading to unexpected rendering of transparent pixels and distortion of input content. This can result in the model misinterpreting image content, potentially affecting the integrity of processed data.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ai Inference Server Enterprise Linux Ai Openshift Ai
CVE-2026-6855

Instructlab: instructlab: path traversal allows arbitrary directory creation and file write

A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Ai Instructlab
CVE-2026-6859

Instructlab: instructlab: arbitrary code execution due to hardcoded `trust_remote_code=true`

A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Ai Instructlab
CVE-2026-6385

Ffmpeg: ffmpeg: denial of service and potential arbitrary code execution via signed integer overflow in dvd subtitle parser

A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg Redhat
Products
Ffmpeg Ai Inference Server Enterprise Linux Ai and 2 more
CVE-2024-8768

Vllm: a completions api request with an empty prompt will crash the vllm api server.

A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Ai
CVE-2025-6242

Vllm: server side request forgery (ssrf) in mediaconnector

A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ai Inference Server Enterprise Linux Ai
CVE-2024-8939

Vllm: denials of service in vllm json web api

A vulnerability was found in the ilab model serve component, where improper handling of the best_of parameter in the vllm JSON web API can lead to a Denial of Service (DoS). The API used for LLM-based sentence or chat completion accepts a best_of parameter to return the best completion from several options. When this parameter is set to a large value, the API does not handle timeouts or resource exhaustion properly, allowing an attacker to cause a DoS by consuming excessive system resources. This leads to the API becoming unresponsive, preventing legitimate users from accessing the service.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Ai
CVE-2024-32619

hdf5: multiple CVEs

HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5T_copy_reopen in H5T.c, resulting in the corruption of the instruction pointer.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Hdfgroup Redhat
Products
Hdf5 Enterprise Linux Ai
CVE-2024-32620

hdf5: multiple CVEs

HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5F_addr_decode_len in H5Fint.c, resulting in the corruption of the instruction pointer.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Hdfgroup Redhat
Products
Hdf5 Enterprise Linux Ai
CVE-2024-32621

hdf5: multiple CVEs

HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5HG_read in H5HG.c (called from H5VL__native_blob_get in H5VLnative_blob.c), resulting in the corruption of the instruction pointer.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Hdfgroup Redhat
Products
Hdf5 Enterprise Linux Ai
CVE-2024-32622

hdf5: multiple CVEs

HDF5 Library through 1.14.3 contains a out-of-bounds read operation in H5FL_arr_malloc in H5FL.c (called from H5S_set_extent_simple in H5S.c).

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Hdfgroup Redhat
Products
Hdf5 Enterprise Linux Ai
CVE-2024-32623

hdf5: multiple CVEs

HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5VM_array_fill in H5VM.c (called from H5S_select_elements in H5Spoint.c).

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hdfgroup Redhat
Products
Hdf5 Enterprise Linux Ai
CVE-2024-32624

hdf5: multiple CVEs

HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5T__ref_mem_setnull in H5Tref.c (called from H5T__conv_ref in H5Tconv.c), resulting in the corruption of the instruction pointer.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Hdfgroup Redhat
Products
Hdf5 Enterprise Linux Ai
CVE-2024-32605

hdf5: multiple CVEs

HDF5 Library through 1.14.3 has a heap-based buffer over-read in H5VM_memcpyvv in H5VM.c (called from H5D__compact_readvv in H5Dcompact.c).

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hdfgroup Redhat
Products
Hdf5 Enterprise Linux Ai