CVE-2026-94627: Missing Release of Memory after Effective Lifetime

vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts,...

TencentOS Server 3: kernel (TSSA-2026:1026)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1026 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

RHEL 8 : unbound (RHSA-2026:69120)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69120 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via...

Linux Distros Unpatched Vulnerability : CVE-2026-93748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticate...

AlmaLinux 8 : unbound (ALSA-2026:69120)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:69120 advisory. unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 Tenable has extracted the preceding description block directly from the...

ALSA-2026:69120 Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

Linux Distros Unpatched Vulnerability : CVE-2026-93750

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the varyMatches function that fails to properly validate Vary header wildcards d...

Debian dsa-6507 : libunbound-dev - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6507 advisory. ------------------------------------------------------------------------- Debian Security Advisory DSA-6507-1 [email protected] https://www.debian.org/security/...

SUSE SLED15: libzypp / libzypp-devel / zypper / zypper-log / etc (SUSE-SU-2026:4092-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4092-1 advisory. Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625....

Security update for coredns (important)

openSUSE Security Update: Security update for coredns Announcement ID: openSUSE-SU-2026:0324-1 Rating: important References: 1276712 Cross-References: CVE-2026-27140 CVE-2026-27143 CVE-2026-27144 CVE-2026-32282 CVE-2026-32283 CVE-2026-32288 CVE-2026-32289 CVE-2026-32934 CVE-2026-32936...

Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

EulerOS Virtualization 2.10.0 : httpd (EulerOS-SA-2026-3869)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : locking/rtmutex: Skip removewaiter when waiter is not enqueuedCVE-2026-53163 ppp: require CAPNETADMIN in target netns for unattached...

Exploit for Out-of-bounds Write in Linux Linux_Kernel

CVE-2026-53266 — Linux ebtables SNAT ARP-rewrite page-cache wr...

[SECURITY] [DSA 6507-1] unbound security update

5B------------------------------------------------------------------------- Debian Security Advisory DSA-6507-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 19, 2026 https://www.debian.org/security/faq -...

CVE-2026-76579

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

EUVD-2026-83568

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-76579 LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-76579

LiteSpeed Cache for WordPress (all versions up to and including 7.9 ) contains a Reflected Cross-Site Scripting vulnerability in the ESI (esi) parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts by supplying a validly sign...

CVE-2026-76579 LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-92099

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own...