Media
CVE-2026-105754
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 152
Restablecer filtros
Media
CVE-2026-105755
vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`
Crítica
CVE-2025-66455
LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py
Alta
CVE-2026-33625
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
Media
CVE-2026-69147
vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation
Alta
CVE-2025-71365
Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval
Alta
CVE-2025-71370
Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper
Media
CVE-2025-71351
Picklescan missing detection when calling built-in python library function timeit.timeit()
Alta
CVE-2025-71376
Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions
Alta
CVE-2025-71341
Picklescan has a missing detection when calling built-in python profile.Profile.runctx
Alta
CVE-2026-100845
MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files
Sin evaluar
CVE-2026-100841
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MON
Media
CVE-2026-73558
vLLM: Cross-User Data Leak Vulnerability
Media
CVE-2026-73560
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections
Media
CVE-2026-73557
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
Crítica
CVE-2026-79657
NLTK: Allowlisted pickle loaders still permit code execution in current source
Alta
CVE-2026-12484
Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
Alta
CVE-2026-54234
vLLM has Remote DoS via Invalid Recovered Token Reinjection
Alta
CVE-2026-58659
PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters
Crítica
CVE-2026-50027
mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete
Alta
CVE-2026-54499
Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
Media
CVE-2026-53923
vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving
Alta
CVE-2026-46517
lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out
Alta
CVE-2026-8596
Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.