RHSA-2026:19712

A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1.

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing.

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing.

PyJWT is a JSON Web Token implementation in Python.

pyasn1 is a generic ASN.1 library for Python.

pyasn1 is a generic ASN.1 library for Python.

A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader.

A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths.

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol.

node-tar is a Tar for Node.js.

vLLM is an inference and serving engine for large language models (LLMs).

Axios is a promise based HTTP client for the browser and Node.js.

python-dotenv reads key-value pairs from a .env file and can set them as environment variables.

vLLM is an inference and serving engine for large language models (LLMs).

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427.

Axios is a promise based HTTP client for the browser and Node.js.

urllib3 is an HTTP client library for Python.

gRPC-Go is the Go language implementation of gRPC.

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

vLLM is an inference and serving engine for large language models (LLMs).

Immutable.js provides many Persistent Immutable data structures.

urllib3 is a user-friendly HTTP client library for Python.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Axios is a promise based HTTP client for the browser and Node.js.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…

lz4_flex is a pure Rust implementation of LZ4 compression/decompression.

vLLM is an inference and serving engine for large language models (LLMs).

The net/url package does not set a limit on the number of query parameters in a query.

Python-Multipart is a streaming multipart parser for Python.

vLLM is an inference and serving engine for large language models (LLMs).

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

urllib3 is a user-friendly HTTP client library for Python.

Glob matches files using patterns the shell uses.

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.

React Router is a router for React.

React Router is a router for React.

React Router is a router for React.

Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set.