[ Vendor · 13 CVEs ]
kvcache-ai
CVEs affecting kvcache-ai published in the last 30 days, plus any kvcache-ai CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-106039 | 6 Oct 2026 | CVSS 6.5 | kvcache-ai MooncakeMooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and… | |
| CVE-2026-106040 | 6 Oct 2026 | CVSS 8.2 | kvcache-ai MooncakeMooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's… | |
| CVE-2026-106041 | 6 Oct 2026 | CVSS 6.5 | kvcache-ai MooncakeMooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed… | |
| CVE-2026-106037 | 6 Oct 2026 | CVSS 9.8 | kvcache-ai MooncakeMooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without… | |
| CVE-2026-106038 | 6 Oct 2026 | CVSS 8.2 | kvcache-ai MooncakeMooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any… | |
| CVE-2026-104433 | 3 Oct 2026 | CVSS 7.5 | kvcache-ai MooncakeMooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows… | |
| CVE-2026-103764 | 2 Oct 2026 | CVSS 9.8 | kvcache-ai MooncakeMooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers… | |
| CVE-2026-103765 | 2 Oct 2026 | CVSS 9.4 | kvcache-ai MooncakeMooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows… | |
| CVE-2026-103760 | 1 Oct 2026 | CVSS 5.9 | kvcache-ai MooncakeMooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the… | |
| CVE-2026-103761 | 1 Oct 2026 | CVSS 7.5 | kvcache-ai MooncakeMooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows… | |
| CVE-2026-96763 | 24 Sep 2026 | CVSS 5.4 | kvcache-ai mooncakeA security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function… | |
| CVE-2026-96764 | 24 Sep 2026 | CVSS 4.3 | kvcache-ai mooncakeA weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex of the… | |
| CVE-2026-96762 | 24 Sep 2026 | CVSS 7.3 | kvcache-ai mooncakeA vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path… |