What’s Vulnerable › Products

kvcache-ai Mooncake vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Check whether your kvcache-ai Mooncake version is affected

Latest kvcache-ai Mooncake vulnerabilities

• CVE-2026-106041 — Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC (CVSS 6.5)
• CVE-2026-106040 — Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC (CVSS 8.2)
• CVE-2026-106039 — Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC (CVSS 6.5)
• CVE-2026-106038 — Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs (CVSS 8.2)
• CVE-2026-106037 — Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service (CVSS 9.8)
• CVE-2026-104433 — Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString (CVSS 7.5)
• CVE-2026-103765 — Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server (CVSS 9.4)
• CVE-2026-103764 — Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport (CVSS 9.8)
• CVE-2026-103761 — Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue (CVSS 7.5)
• CVE-2026-103760 — Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write (CVSS 5.9)
• CVE-2026-96764 — kvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resources (CVSS 4.3)
• CVE-2026-96763 — kvcache-ai mooncake MountSegment Request Processing segment.cpp access control (CVSS 5.4)
• CVE-2026-96762 — kvcache-ai mooncake RPC Path UnmountSegment authorization (CVSS 7.3)