CVE-2026-105755 vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's querykey value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can...

CVE-2026-105754 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargsdata field, cache identifiers in the features.mmhashes field, ranges in the...

CVE-2026-105754 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargsdata field, cache identifiers in the features.mmhashes field, ranges in the...

Astra Linux – Vulnerability in Firefox

While the text displayed in Autofill tooltips cannot be directly read by JavaScript, it was rendered using page fonts. Side-channel attacks on the text using specially crafted fonts could have led to this text being interpreted by the webpage. This vulnerability affects Firefox versions earlier...

CVE-2026-105754: Improper Input Validation

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargsdata field, cache identifiers in the features.mmhashes field, ranges in the...

Hidden Risks of Jev: An Empirical Study of Security, Privacy, and Dual Use

Jev turns natural-language questions into typed answers and probabilities with low latency and cost, enabling applications to route requests and select tools. While this interface allows Jev to integrate naturally into application workflows as a decision layer, the security and privacy implicatio...

Static Bootstrap Placement for Encrypted Language Model Decoding

Language models increasingly serve prompts that carry private data, and secure inference under homomorphic encryption lets a client outsource the computation without revealing the prompt. Existing secure inference systems run a forward pass without consuming a token under encryption, and generati...

CVE-2026-101918 vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-horizon-2025.2, airflow-core, openstack-barbican-2026.1, openstack-placement-2026.1-fips, airflow, openstack-horizon-2025.2-fips, openstack-designate-2025.2, openstack-horizon-2026.1-fips, awx, superset, openstack-manila-2025.2,...

GHSA-42VR-XJ54-VC7V vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-horizon-2025.2, airflow-core, openstack-barbican-2026.1, openstack-placement-2026.1-fips, airflow, openstack-horizon-2025.2-fips, openstack-designate-2025.2, openstack-horizon-2026.1-fips, awx, superset, openstack-manila-2025.2,...

gllm-core-binary (>=0.0.0.dev0, <=0.4.4b3), gllm-inference-binary (0.5.51b3) +5 more potentially affected by CVE-2026-102937 via virtualenv (20.30.0)

virtualenv PYPI version 20.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - gllm-core-binary =0.0.0.dev0, =0.3.149, =0.1.0, =1.0.51, =0.4.4, =0.4.8 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3...

gllm-core-binary (>=0.0.0.dev0, <=0.4.4b3), gllm-inference-binary (0.5.51b3) +5 more potentially affected by CVE-2026-102938 via virtualenv (20.30.0)

virtualenv PYPI version 20.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - gllm-core-binary =0.0.0.dev0, =0.3.149, =0.1.0, =1.0.51, =0.4.4, =0.4.8 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-G...

GHSA-R6X4-923Q-G947 vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-horizon-2025.2, airflow-core, mcp-atlassian, openstack-placement-2026.1-fips, py3-cassandra-medusa, openstack-horizon-2025.2-fips, openstack-designate-2025.2, openstack-horizon-2026.1-fips, superset, openstack-manila-2025.2,...

GHSA-W2CX-738M-MC7W vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-horizon-2025.2, airflow-core, mcp-atlassian, openstack-placement-2026.1-fips, py3-cassandra-medusa, openstack-horizon-2025.2-fips, openstack-designate-2025.2, openstack-horizon-2026.1-fips, superset, openstack-manila-2025.2,...

GHSA-HXM8-2XGR-2P9M vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-horizon-2025.2, airflow-core, mcp-atlassian, openstack-placement-2026.1-fips, airflow, py3-cassandra-medusa, openstack-horizon-2025.2-fips, openstack-designate-2025.2, openstack-horizon-2026.1-fips, superset, openstack-manila-2025....

CVE-2026-49265 vulnerabilities

Vulnerabilities for packages: jupyterhub-k8s-singleuser-sample, jupyter-base-notebook, kserve-xgbserver, mcp-atlassian, airflow, chroma, ansible-operator-fips, awx, kserve-lgbserver, kserve-models-web-app, pgadmin4, kubeflow-katib, kserve-pmmlserver, openstack-keystone-2025.2,...

GHSA-HJ66-6F7G-4R5V vulnerabilities

Vulnerabilities for packages: jupyterhub-k8s-singleuser-sample, jupyter-base-notebook, kserve-xgbserver, mcp-atlassian, airflow, chroma, ansible-operator-fips, awx, kserve-lgbserver, kserve-models-web-app, pgadmin4, kubeflow-katib, kserve-pmmlserver, openstack-keystone-2025.2,...

GHSA-XPV3-W29H-X7CV vulnerabilities

Vulnerabilities for packages: jupyterhub-k8s-singleuser-sample, jupyter-base-notebook, kserve-xgbserver, mcp-atlassian, airflow, chroma, ansible-operator-fips, awx, kserve-lgbserver, kserve-models-web-app, pgadmin4, kubeflow-katib, kserve-pmmlserver, openstack-keystone-2025.2,...

CVE-2026-49264 vulnerabilities

Vulnerabilities for packages: jupyterhub-k8s-singleuser-sample, jupyter-base-notebook, kserve-xgbserver, mcp-atlassian, airflow, chroma, ansible-operator-fips, awx, kserve-lgbserver, kserve-models-web-app, pgadmin4, kubeflow-katib, kserve-pmmlserver, openstack-keystone-2025.2,...

GHSA-W6J9-CWV2-H6WQ vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-horizon-2025.2, airflow-core, mcp-atlassian, openstack-placement-2026.1-fips, airflow, py3-cassandra-medusa, openstack-horizon-2025.2-fips, openstack-designate-2025.2, openstack-horizon-2026.1-fips, superset, openstack-manila-2025....

CVE-2026-102274 vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-horizon-2025.2, airflow-core, mcp-atlassian, openstack-placement-2026.1-fips, airflow, py3-cassandra-medusa, openstack-horizon-2025.2-fips, openstack-designate-2025.2, openstack-horizon-2026.1-fips, superset, openstack-manila-2025....