1Diot9

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track http metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus's Family::get or create function to permanently create counter and histogram label sets. Those label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted. This issue is fixed in version 0.30.0.

**Name of the Vulnerable Software and Affected Versions** Grav versions 2.0.0 through 2.0.24 **Description** A Twig content sandbox escape exists where the `array` filter is included in the sandbox allowlist without the necessary `needs is sandboxed` guard. This allows the filter to call `toArray()` or perform an `(array)` cast without verifying the sandbox method allowlist. Since the `grav` Twig global acts as a Pimple-based dependency injection container (a tool used to manage object instantiation and dependencies), an attacker capable of authoring Twig in page content can use `grav|array` to access the container's private `$values` array. This process can expose the un-redacted Config service and the entire configuration tree, disclosing sensitive data such as plugin credentials, SMTP and OAuth secrets, Redis passwords, proxy URLs, and the `security.*` subtree. The exposed information is then rendered to anonymous visitors. **Recommendations** Update to version 2.0.25.

**Name of the Vulnerable Software and Affected Versions** File Browser versions prior to 2.63.24 **Description** A memory exhaustion issue exists in the subtitle conversion endpoint. The system loads entire subtitle files into memory without imposing size limits. Authenticated users with download permissions can trigger a denial of service by submitting concurrent requests to convert large `.srt`, `.ass`, or `.ssa` files, which exhausts the server memory. **Recommendations** Update to a version newer than 2.63.23.