tokenize

CVE-2026-114053: vLLM code_revision RCE via /tokenize

vLLM Will Import Your Attacker’s Processor If You Ask Nicely (CVE-2026-114053)

Cybersecsloth Editorial5 hours ago05 mins

Request-controlled code_revision reaches AutoProcessor.from_pretrained. Unauthenticated /tokenize, trust_remote_code, auto_map. Lab recreation and the 0.31.0 fix.

Read Full News

meme dump: patch your stuff edition

Mistune’s RST Include Just Read Your .env (CVE-2026-115353)

Incus Backup Import: ../ in a Volume Name, Root on the Host (CVE-2026-115375)

vLLM Will Import Your Attacker’s Processor If You Ask Nicely (CVE-2026-114053)

WebRTC Datachannels: C2 That Looks Like a Call Your Firewall Already Allows

Your C2 Is a WebSocket Upgrade and the Proxy Logged It as Chat

Linux Fileless ELF: memfd_create, fexecve, and a Fake kworker Name

Plex2Shell: Your Home Theater Just Joined CISA KEV and Learned dlopen

PHP2Shell Just Turned Every Unpatched Upload Form Into a Shell Lottery

Verify or Burn a Claim: Chaining Photo, Map, and Public Records

vLLM Will Import Your Attacker’s Processor If You Ask Nicely (CVE-2026-114053)