SUSE CVE-2026-93841

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton bincountkernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing...

firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video: Web Codecs component...

SUSE CVE-2026-89892

In the Linux kernel, the following vulnerability has been resolved: media: em28xx: defer audio-only extension registration The audio-only path registers extensions while probing the primary device. For a dual-TS board, this happens before devnext is created. The duplicate device inherits...

Out-of-bounds Write

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Out-of-bounds Write via the Triton bincountkernel, where prompt token IDs index the penalty prompt-presence bitset without bounds checking against t...

CVE-2026-93841

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton bincountkernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing...

PYSEC-0000-CVE-2026-93841

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton bincountkernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing...

CVE-2026-40536

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Audio API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40536

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Audio API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40536

CVE-2026-40536 is a path traversal vulnerability in the Audio API of Synology DiskStation Manager (DSM) . Remote authenticated users can access files outside the restricted directory, obtaining non-sensitive information. The flaw is an improper limitation of a pathname to a restricted directory. ...

EUVD-2026-82790

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Audio API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40536

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Audio API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

SUSE CVE-2026-57173

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the inputaudio handling path for /v1/chat/completions calls AudioMediaIO.loadbytes or AudioMediaIO.loadfile without passing VLLMMAXAUDIODECODEDURATIONS to the shared audio decoder. An unauthenticated client can...

CVE-2026-93841: Improper Validation of Array Index

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton bincountkernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing...

PT-2026-95324

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description A path traversal issue exists in the Audio API,...

CVE-2026-40536: Improper Limitation of a Pathname to a Restricted Directory

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Audio API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

ROS-20260918-73-0118

The vulnerability of the parseaudiounit function in the sound/usb/mixer.c module, which supports USB audio devices in Linux operating systems, is related to the repeated use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A malicious Remote Desktop Protocol RDP server can exploit a heap buffer overflow vulnerability during Opus audio decoding. This occurs when the server negotiates Opus audio with a vulnerable client, causing the...

CVE-2026-92063

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the Audio/Video component...

SUSE CVE-2026-90033

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidius122loutput The sndusbmidius122loutput picks a count of 2 on anything slower than high speed and never relates it to ep-maxtransfer. The URB buffer holds exactly maxtransfer bytes, so ...

firefox: Use-after-free in the Audio/Video component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video component...