CVE-2026-105245

LowCVSS 3.7/10Last modified Oct 7, 2026

Description

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function server_info of the file python/sglang/srt/entrypoints/http_server.py of the component HTTP Endpoint. Such manipulation of the argument api_key leads to cleartext transmission of sensitive information. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-310 CWE-319

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2026
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1052467.3A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/a CVE-2026-1052477.3A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the f CVE-2026-1052486.3A security flaw has been discovered in vgmstream up to r2117. This affects the function parse_params/txtp_parse of the file src/meta/txtp_pa CVE-2026-1052494.8A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of CVE-2026-105256.1The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back CVE-2026-1052504.3A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file src/coding/ima_decod CVE-2026-1052516.3A vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function ps_find_padding of the file src/coding CVE-2026-1052537.3A vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file /CVE-2026-1052546.3A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.ph CVE-2026-1052565.3The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking ag CVE-2026-1052572.7The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a custom CVE-2026-105265.8The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticate