NVD disclosure day

Published threat advisories for February 2, 2026

CVE-2026-22778

vLLM Multimodal Endpoint Heap Leak Allows Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A vulnerability in vLLM's multimodal endpoint may allow remote code execution when an invalid image is sent, by leaking heap addresses and bypassing security measures. This critical issue affects versions prior to 0.14.1.

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2025-8587

AKCE SKSPro SQL Injection Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical SQL injection vulnerability exists in AKCE Software Technology's SKSPro software, potentially allowing attackers to manipulate the database. If reachable, this could lead to unauthorized access, modification, or disclosure of sensitive data, impacting system integrity and confidentiality. Confirmation of SKS

NVD modified: NVD date unavailable