ROS-20260928-73-0004

The vulnerability of the drivers/gpu/drm/vmwgfx cores in the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

ROS-20260928-73-0084

The vulnerability of the Linux operating system’s components such as drivers, GPU, DRM, AMD, and AMDGPU cores is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2026-100839 Contrast before 1.18.0 AML Injection Remote Code Execution

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack "BadAML". ACPI tables containing AML bytecode are passed from the untrusted host QEMU to the guest firmware OVMF and on to the Linu...

CVE-2026-100839

In versions before 1.18.0 , the Contrast confidential-computing runtime for Kubernetes is vulnerable to an AML injection attack (known as "BadAML"). An attacker controlling the host can pass malicious, Turing-complete AML bytecode via ACPI tables to the guest firmware (OVMF) and the Linux kernel....

CVE-2026-100839 Contrast before 1.18.0 AML Injection Remote Code Execution

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack "BadAML". ACPI tables containing AML bytecode are passed from the untrusted host QEMU to the guest firmware OVMF and on to the Linu...

CVE-2026-100839 Contrast before 1.18.0 AML Injection Remote Code Execution

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack "BadAML". ACPI tables containing AML bytecode are passed from the untrusted host QEMU to the guest firmware OVMF and on to the Linu...

CVE-2026-100839: Improper Control of Generation of Code

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack "BadAML". ACPI tables containing AML bytecode are passed from the untrusted host QEMU to the guest firmware OVMF and on to the Linu...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via PyNvVideoCodecVideoBackendMixin, where sampler subclass shadowing causes independent...

CVE-2026-100649

A flaw was found in vLLM. An unauthenticated remote attacker can cause a Denial of Service DoS by submitting video processing requests that specify different sampler subclasses. Because active decoder counters are tracked independently across subclasses rather than globally, requests can bypass...

CVE-2026-100649

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

CVE-2026-100652

A flaw was found in vLLM. A remote attacker can trigger a Denial of Service DoS by sending requests containing stop token identifiers that exceed the supported vocabulary limits. Because the application's service frontends fail to properly validate these identifiers before internal processing, th...

CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

CVE-2026-100649

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

CVE-2026-100649

Versions of vLLM prior to 0.29.0 are vulnerable to a resource-limit bypass within the PyNvVideoCodec decoder allocation. The root cause is sampler subclass shadowing , which allows for independent counter increments rather than global tracking. An unauthenticated remote attacker can exploit this ...

CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

EUVD-2026-87743

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

Astra Linux – Vulnerability in Chromium

In Google Chrome versions prior to 152.0.7977.65, an uninitialized resource in the GPU allowed a remote attacker who had compromised the renderer process to potentially read memory outside of the sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

In Google Chrome versions prior to 152.0.7977.65, an uninitialized resource in the GPU allowed a remote attacker who had compromised the renderer process to potentially read memory outside of the sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Integer overflow in the GPU in Google Chrome prior to version 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium security severity: High...