[{"data":1,"prerenderedAt":58},["ShallowReactive",2],{"sicherheitsluecke-cve-2026-115915":3},{"l":4,"details":26,"weitere":36,"indexierbar":56,"updated":57},{"cve":5,"status":6,"vendor":7,"product":7,"name":8,"added":9,"due":8,"ransomware":10,"published":9,"cwes":11,"cvss":14,"epss":19,"slug":22,"bereich":23,"schweregrad":24,"art":25,"produktLabel":7},"CVE-2026-115915","gemeldet","vLLM","","2026-10-26",false,[12,13],"CWE-20","CWE-183",{"version":15,"score":16,"severity":17,"vector":18},"3.1",9.8,"CRITICAL","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"score":20,"percentile":21},0.0066,0.51896,"cve-2026-115915","dev","kritisch","Unzureichende Prüfung von Eingaben",{"description":27,"refs":28},"vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.",[29,32,34],{"url":30,"host":31},"https:\u002F\u002Fgithub.com\u002Fvllm-project\u002Fvllm\u002Fcommit\u002F710ac56e691d4713feca50a43e6c440f07d373fd","github.com",{"url":33,"host":31},"https:\u002F\u002Fgithub.com\u002Fvllm-project\u002Fvllm\u002Fpull\u002F60022",{"url":35,"host":31},"https:\u002F\u002Fgithub.com\u002Fvllm-project\u002Fvllm\u002Fsecurity\u002Fadvisories\u002FGHSA-h3rc-j82p-2c3h",[37,45,51],{"cve":38,"status":6,"produktLabel":39,"vendor":40,"product":41,"art":42,"bereich":23,"schweregrad":24,"score":43,"epss":-1,"added":44,"ransomware":10},"CVE-2026-120779","Microsoft Visual Studio Code","Microsoft","Visual Studio Code","Einschleusen von Programmcode (Code Injection)",9.6,"2026-11-10",{"cve":46,"status":6,"produktLabel":47,"vendor":8,"product":47,"art":48,"bereich":23,"schweregrad":24,"score":49,"epss":50,"added":44,"ransomware":10},"CVE-2026-125370","Kubero","Fest eingebauter Schlüssel für die Verschlüsselung",9.3,0.00683,{"cve":52,"status":6,"produktLabel":53,"vendor":8,"product":53,"art":54,"bereich":23,"schweregrad":24,"score":55,"epss":-1,"added":44,"ransomware":10},"CVE-2026-125758","Aptabase","Unsichere Standardeinstellung",9.1,true,"2026-11-11T14:28:43.107Z",1794407353139]