CVE-2026-101914 @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path method name matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service...

CVE-2026-101914 @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path method name matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service...

CVE-2026-101914

The @grpc/grpc-js library (versions prior to 1.13.1 and 1.14.1 ) contains an authorization flaw where the exact path matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. This allows a request for a longer service method nam...

EUVD-2026-88464

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path method name matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service...

CVE-2026-101914 @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path method name matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service...

milvus-auth-audit

milvus-auth-audit Script de detección de seguridad de autenticación de Milvus. Detecta tres vulnerabilidades de autenticación: Vulnerabilidad| CVE| Versiones afectadas| Método de detección ---|---|---|--- Bypass de autenticación mediante backdoor sourceid| CVE-2025-64513| --port 19530 --mgmt-port...

CVE-2026-78424 OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

CVE-2026-78424

Improper parameter handling in NeuVector allows for OS command injection within the privileged enforcer container, potentially leading to a complete compromise of the worker node. This vulnerability affects NeuVector versions 5.4 before 5.4.11 , 5.5 before 5.5.4 , 5.6 before 5.6.2 , and potential...

POC_CVE-2026-42880

CVE-2026-42880 — Exposición de Secretos de ArgoCD mediante ServerSideDiff Un entorno de laboratorio para reproducir y detectar CVE-2026-42880 , una vulnerabilidad crítica en Argo CD donde el manejador gRPC ServerSideDiff expone datos de Secretos de Kubernetes a usuarios de solo lectura. Resumen d...

google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a...

Important: Red Hat Security Advisory: rhc security update

An update for rhc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

CVE-2026-101915: Server-generated Error Message Containing Sensitive Information

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...

CVE-2026-101914: Partial String Comparison

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path method name matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service...

CVE-2026-101916: Improper Certificate Validation

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

EXPLOIT-CVE-2026-56121

CVE-2026-56121 — Ejecución remota de código no autenticada en Feast deserialización gRPC de ApplyFeatureView Ejecución remota de código no autenticada en Feast ⚠️ Solo para pruebas de seguridad autorizadas y fines educativos. Ejecútalo únicamente contra el laboratorio Docker incluido o sistemas qu...

CVE-2026-100652

vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...

EUVD-2026-87746

vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...

CVE-2026-100652

vLLM versions 0.22.0 through 0.23.0 are vulnerable to a Denial of Service (DoS) due to a lack of validation for stop_token_ids in the Rust HTTP and gRPC frontends . If an attacker submits requests with min_tokens greater than zero and out-of-vocabulary token IDs, the values reach the MinTokensLog...

CVE-2026-100652 vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids

vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...

CVE-2026-100652 vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids

vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...