Cisco ASA Improper Access Control (CVE-2019-1695)

A vulnerability in the detection engine of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, adjacent attacker to send data directly to the kernel of an affected device. The vulnerability exists because the software...

CVE-2026-67273: Improper Neutralization of Special Elements Used in a Template Engine

Dell Container Storage Modules, versions prior to 1.18.0, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

PT-2026-106765

Name of the Vulnerable Software and Affected Versions Dell Container Storage Modules versions prior to 1.18.0 Description An improper neutralization of special elements used in a template engine allows a low privileged attacker with remote access to potentially achieve elevation of privileges...

CVE-2026-41091

🛡️ CVE-2026-41091 - RedSun Vulnerabilidad de Elevación de Privilegios en Microsoft Defender RedSun es una técnica de escalada de privilegios local LPE y PoC asociado que abusa de una vulnerabilidad de seguimiento de enlaces en el Motor de Protección contra Malware de Microsoft Defender. Permite a...

EUVD-2026-88981

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup...

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Impact This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine. Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such a...

GHSA-WFPM-5GCM-94CG Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Impact This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine. Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such a...

Browser-Pwning-

Browser-Pwning A proper well structured documentation for getting started with chrome pwning & v8 pwning Structure of document How this doc is organised 1. Motivation 2. Actual Study Material Motivation Browsers are one of today’s most used pieces of technology. On every off the shelf computer, i...

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back each path reaches. Summary Three structured-output request paths let an ordinary request reach a condition...

GHSA-85XF-C7HM-WHQW vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back each path reaches. Summary Three structured-output request paths let an ordinary request reach a condition...

Enigma-

Enigma C++ reimplementation of Ghidra's analytical core SoftwareModeling + Utility, stripped of Java/JVM dependencies. Built for AI integration, performance, and embeddability. Part of the Enigma Engine project. Enigma Engine A C++ reimplementation of Ghidra's analytical core — no JVM, no Java,...

NetLogic

NetLogic Mapeador de Superficie de Ataque Nativo en la Nube y Correlacionador de Vulnerabilidades — v3.0 NetLogic es una plataforma de seguridad de red que combina escaneo activo de puertos, correlación CVE API NVD en vivo, análisis SSL/TLS, auditoría de seguridad HTTP, evaluación de seguridad...

CVE-2026-105755 vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's querykey value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can...

CVE-2026-105754 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargsdata field, cache identifiers in the features.mmhashes field, ranges in the...

AZL-106821 CVE-2026-93321 affecting package moby-engine 25.0.3-20

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon...

CVE-2025-9074

CVE-2025-9074 – Docker Desktop Windows Container→Host Write via Exposed Engine API Author: w01f Status: Proof-of-Concept educational / authorized testing only Overview This project demonstrates a PoC for CVE-2025-9074 , a misconfiguration/exposure in certain versions of Docker Desktop for Windows...

CVE-2026-105746 Docling: KServe v2 OCR engine does not enforce enable_remote_services

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kservev2ocrmodel.py sends page images to its configured endpoint without checki...

CVE-2026-105746

The Docling document processing library (versions 2.83.0 through 2.131.0 ) contains a flaw where the KServeV2OcrModel class fails to honor the pipeline_options.enable_remote_services setting. This oversight allows the application to transmit page images to configured external endpoints even when ...

CVE-2026-105746 Docling: KServe v2 OCR engine does not enforce enable_remote_services

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kservev2ocrmodel.py sends page images to its configured endpoint without checki...

CVE-2026-105746 Docling: KServe v2 OCR engine does not enforce enable_remote_services

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kservev2ocrmodel.py sends page images to its configured endpoint without checki...