CVE-2026-126396

The vLLM library (versions 0.24.0 to before 0.31.0 ) is vulnerable to a resource exhaustion issue within the MiniMax M3 VL video processor . The root cause is the lack of range validation or min_pixels

EUVD-2026-125169

vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level minpixels without range or minpixels = maxpixels validation. Its video-wide pixel budget is enforced only when maxlongsidepixel is set, and that value...

CVE-2026-126396 vLLM from 0.24.0 before 0.31.0 Resource Exhaustion via MiniMax M3 min_pixels

vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level minpixels without range or minpixels = maxpixels validation. Its video-wide pixel budget is enforced only when maxlongsidepixel is set, and that value...

EUVD-2026-125036

Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host memory when a component receives a borrow of a resource it defines itself, bypassing the per-store handle limit. A malicious guest component can repeatedly transfer such borrowed...

CVE-2026-126407

The Wasmtime runtime is vulnerable to a Denial of Service (DoS) attack in versions before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1. The root cause is that the engine allocates untracked host memory when a component receives a borrow of a resource it defined it...

CVE-2026-127088

The 2FAuth software (versions before 9.0.1 ) is vulnerable to a weak password recovery mechanism caused by improper handling of the HTTP Host header . An unauthenticated attacker can forge this header to poison password or WebAuthn recovery links. By providing an attacker-controlled host, the att...

EUVD-2026-125094

2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over...

Malicious code in r17d-sec-research-marker (npm)

Source: amazon-inspector 0dbf3def098b1620e001e0831b405dd03ec20787a88a28892163cdfbe2eadbee On npm install, the package's postinstall script collect.js runs shell listings of the home directory and current working directory, probes for the presence of installer credential/config files /.npmrc,...

Malicious code in math-helpers-extra-utils (npm)

Source: amazon-inspector cc75601c6416f2ac62b69fb197e0338f1e9a878fe15e83a48fc25c9aea8bbe55 [email protected] is advertised as 'Extra math helper utilities' and ships an empty index.js, but also includes thunderboltRegistry.js which registers factories under Wix-internal registry names...

Malicious code in @securihackbot/depconf-flow-1792484611 (npm)

Source: amazon-inspector 6dc8c3628b1d44eca51a5cde6143c1760a5d393b45729f174bab73f76f8641e8 Package publishes under the @securihackbot scope as a public dependency-confusion squat of an internal name. The declared postinstall script executes postinstall.js, which on npm install collects host...

RLSA-2026:97561 Important: crun security, bug fix, and enhancement update

crun is a OCI runtime Security Fixes: crun: crun: rootful krun with passt executes container payload as host root CVE-2026-84042 Bug Fixes and Enhancements: crun should require container-selinux JIRA:Rocky Linux-169227 update to the latest upstream release JIRA:Rocky Linux-185741 For more details...

crun security, bug fix, and enhancement update

An update is available for crun. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list crun is a OCI runtime Security Fixes: crun: crun: rootful krun with passt execut...

CVE-2026-34835-Black-box-Analysis

This repository provides a black-box security analysis of CVE-2026-34835 from the perspective of an external penetration tester. The objective is not to reverse engineer the vulnerability, but to document how a security assessor can identify, validate, and evaluate its impact during an authorized...

wasm2c-tableflip

wasm2c sandbox escape: guest module runs a shell command on the host Read the blog: trustsig.eu/blog wasmrtallocatefuncreftable in wasm2c/wasm-rt-impl-tableops.inc sets table-size from the module's declared element count and then ignores the result of calloc. When the allocation fails the table i...

auditd

/ | / // / / /| |/ / / / / / / / / / // / // / / // // / // |,/,///,/ Best Practice Auditd Configuration Idea The idea of this auditd configuration is to provide a best-practice baseline that is designed to load out-of-the-box on major Linux distributions covers a broad set of security-relevant...

netview

= netview Netview is a enumeration tool. It uses with the -d the current domain or a specified domain with the -d domain to enumerate hosts. You can also use the -f if you wish to specify a file with a list of hosts instead. Any hostnames you wish to exclude can be specified in a list with -e. If...

umap

umap - the USB host security assessment tool Based on Facedancer by Travis Goodspeed: http://goodfet.sourceforge.net/hardware/facedancer21/ Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Andy Davis, andy dot davis at nccgroup dot com...

CVE-2026-1961-foreman-poc

Foreman WebSocket Proxy Command Injection CVE-2026-1961 — PoC Proof-of-concept for a command injection vulnerability in Foreman's WebSocket proxy lib/wsproxy.rb, disclosed responsibly to Red Hat and patched. Summary Foreman's WebSocket proxy interpolates an unsanitized host value, sourced from a...

Zapscape-Fix

Zapscape-Fix — CVE-2026-64561 Kernel Live Patch KVM/x86 English |简体中文 A kernel live patch that fixes CVE-2026-64561 Zapscape on CentOS Stream 8 / RHEL 8 KVM hosts all 4.18.0- kernels. Without the patch : a tenant VM guest can escape to the host with guest-side actions alone and execute code with...

Logsensor

Logsensor A Powerful Sensor Tool to discover login panels, and POST Form SQLi Scanning Features login panel Scanning for multiple hosts Proxy compatibility http, https Login panel scanning are done in multiprocessing so the script is super fast at scanning many urls quick tutorial & screenshots a...