| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions. |
| vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or complete copy of another user's inference result. This issue is fixed in version 0.27.0. |
| Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to execute code over a network. |
| Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| Stack-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges locally. |
| Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network. |
| The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change the state of arbitrary orders.
Exploitation requires WooCommerce to be active and the WP Helper Premium WordPress plugin before 4.7.6's optional order confirmation page module to be enabled. |
| is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. |
| is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. |
| Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. |
| ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cause a system crash. |
| is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. |
| Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. |
| Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. |
| Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions. |
