CLEANSTART-2026-HQ29717 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Security vulnerability affects the temporal-server package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...

CLEANSTART-2026-KS11045 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations

Security vulnerability affects the temporal-server package. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations...

Rockwell Automation Allen-Bradley Stratix 5950 Improper Input Validation (CVE-2018-0228)

A vulnerability in the ingress flow creation functionality of Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to cause the CPU to increase upwards of 100% utilization, causing a denial of service DoS condition on an affected system. The vulnerability is due t...

Linux Distros Unpatched Vulnerability : CVE-2026-88252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sssd. A local user can cause a Denial of Service DoS by exhausting the responder service's available file descriptors system handles used fo...

Linux Distros Unpatched Vulnerability : CVE-2026-104712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal...

PT-2026-106587

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description A race condition exists in the POSIX CPU timer code. The issue stems from the conversion of cpu timer::firing from a tristate value to a boolean, which removed the distinction between a tim...

PT-2026-106842

Name of the Vulnerable Software and Affected Versions RabbitMQ Java client library versions prior to 5.37.0 Description A denial of service issue exists in the com.rabbitmq.tools.json.JSONReader.read function. The problem occurs when input ends inside a quoted string or a line comment, as the...

PT-2026-115693

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de thread A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posix cputimers. The task is looked ...

CVE-2026-98258: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 converted cputimer::firing from a tristate value to a boolean. This lost the...

CVE-2026-88252: Loop with Unreachable Exit Condition

A flaw was found in sssd. A local user can cause a Denial of Service DoS by exhausting the responder service's available file descriptors system handles used for open connections. By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection...

Linux Distros Unpatched Vulnerability : CVE-2026-98228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respe...

GHSA-58V5-2M8F-94PR vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

Summary The OpenAI-compatible chat endpoint accepts request-level video loader options through mediaiokwargs. A caller can select the GLMGA sampler and provide large fps and maxframes values. GLMGA first constructs an attacker-sized Python index list and then deduplicates it, even when the suppli...

EUVD-2026-92851

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion...

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

Summary The OpenAI-compatible chat endpoint accepts request-level video loader options through mediaiokwargs. A caller can select the GLMGA sampler and provide large fps and maxframes values. GLMGA first constructs an attacker-sized Python index list and then deduplicates it, even when the suppli...

CVE-2026-105760 vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level mediaiokwargs field to select the GLMGA video backend and supply large values for the fps and maxframes options without a strict work ceiling. GLMGA constructs and deduplicates a...

CVE-2026-105760

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level mediaiokwargs field to select the GLMGA video backend and supply large values for the fps and maxframes options without a strict work ceiling. GLMGA constructs and deduplicates a...

CVE-2026-105760

The vLLM inference and serving engine for large language models is vulnerable to CPU and memory exhaustion in versions prior to 0.30.0 . An attacker can use the media_io_kwargs field to select the GLMGA video backend and provide large values for the fps and max_frames options. Because there is no...

CVE-2026-105760 vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level mediaiokwargs field to select the GLMGA video backend and supply large values for the fps and maxframes options without a strict work ceiling. GLMGA constructs and deduplicates a...

CVE-2026-105760 vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level mediaiokwargs field to select the GLMGA video backend and supply large values for the fps and maxframes options without a strict work ceiling. GLMGA constructs and deduplicates a...

PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Impact . and are not word delimiters in the tokenizer, so a flat selector such as .a.a.a... reaches splitWord as a single word token carrying n class or id indexes. Three passes scanned those index arrays linearly for every index, making the parse On^2 in the number of indexes rather than in inpu...