EUVD-2026-92843

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core...

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the mirrored sender/receiver cache protocol reaches. Summary vLLM's default multimodal cache...

Reachable Assertion

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Reachable Assertion via a P0/P1 multimodal processor cache drift condition in vllm/multimodal/cache.py and the V1 engine core. When the frontend P0...

GHSA-935W-9G4M-P28P vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the tool-continuation re-submission has omitted the salt. Summary On the GPT-OSS "Harmony" path POST...

Use of Cache Containing Sensitive Information

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the /v1/responses endpoint, where tokensinput stores the salt on the engine input only when it is...

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the tool-continuation re-submission has omitted the salt. Summary On the GPT-OSS "Harmony" path POST...

CVE-2026-106038: Missing Authentication for Critical Function

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the cororpc port. Attackers can send forged requests with the force flag set to bypas...

PT-2026-106742

Name of the Vulnerable Software and Affected Versions Mooncake Store versions master through 0.3.13.post1 Description A missing authentication issue allows unauthenticated attackers to force-delete objects via the coro rpc port. By sending forged requests with the force flag set, attackers can...

PT-2026-106559

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xfrm component where the xfrm state delete function failed to use hlist del init rcu for the state cache and state cache input lists, continuing to use hlist del r...

PT-2026-106730

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.1.2 Django versions prior to 6.0.9 Django versions prior to 5.2.18 Description The django.utils.translation.get supported language variant function is susceptible to a denial-of-service attack. This occurs when the...

CVE-2026-39767: Allocation of Resources Without Limits or Throttling

Subscriber Denial of Service Attack in WPBase Cache = 5.5.6 versions...

PT-2026-106439

Name of the Vulnerable Software and Affected Versions WPBase Cache versions prior to 5.5.7 Description A Subscriber Denial of Service DoS issue exists, which allows a user with subscriber privileges to cause a denial of service condition. Recommendations Update to a version newer than 5.5.6...

Linux Distros Unpatched Vulnerability : CVE-2026-93318

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised...

Linux Distros Unpatched Vulnerability : CVE-2026-77050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.translation.getsupportedlanguagevariant is subject to ...

Linux Distros Unpatched Vulnerability : CVE-2026-104041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch NSS responder. Becau...

PT-2026-106690

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the RDMA/rxe component where the rxe check pagefault function failed to properly verify access permissions, checking only for HMM PFN VALID instead of HMM PFN WRITE. This...

CVE-2026-77050: Memory Allocation with Excessive Size Value

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.translation.getsupportedlanguagevariant is subject to a potential denial-of-service attack when processing many distinct, very long language codes, which are retained as keys in an in-memory...

Apache Commons JCS 3.2.1 Unauthenticated Java Deserialization

Summary JCS is a distributed caching system written in Java. It is intended to speed up applications by providing a means to manage cached data of various dynamic natures. Like any caching system, JCS is most useful for high read, low put applications. Latency times drop sharply and bottlenecks...

CVE-2026-104041: Allocation of Resources Without Limits or Throttling

A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch NSS responder. Because the negative cache does not limit the total number of stored entries and only removes expired records when an existing key is rechecke...

CVE-2026-98361: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...