CVE-2026-102271 vulnerabilities

Vulnerabilities for packages: openstack-glance-2025.1, airflow-core, openstack-placement-2025.2, openstack-manila-2025.2, airflow-postgres-fips, openstack-glance-2025.1-fips, openstack-keystone-2026.1, openstack-octavia-2026.1, openstack-placement-2025.1, netbox-fips, openstack-placement-2026.1,...

GHSA-2GX3-RCP4-G85Q vulnerabilities

Vulnerabilities for packages: openstack-glance-2025.1, airflow-core, openstack-placement-2025.2, openstack-manila-2025.2, airflow-postgres-fips, openstack-glance-2025.1-fips, openstack-keystone-2026.1, openstack-octavia-2026.1, openstack-placement-2025.1, netbox-fips, openstack-placement-2026.1,...

GHSA-P4G4-X82P-Q773 vulnerabilities

Vulnerabilities for packages: openstack-glance-2025.1, airflow-core, openstack-placement-2025.2, openstack-manila-2025.2, airflow-postgres-fips, openstack-glance-2025.1-fips, openstack-keystone-2026.1, openstack-octavia-2026.1, openstack-placement-2025.1, netbox-fips, openstack-placement-2026.1,...

CVE-2026-103270

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

CVE-2026-103270

LightLLM versions up to and including 1.2.0 are vulnerable to a missing authentication flaw on reinforcement learning (RL) control routes. When deployments are started with the --enable_rl flag, the software mounts specific control routes on the public HTTP API without requiring authentication ch...

CVE-2026-103270 LightLLM through 1.2.0 Missing Authentication on RL Control Routes

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

EUVD-2026-89989

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

CVE-2026-103270 LightLLM through 1.2.0 Missing Authentication on RL Control Routes

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

Important: Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (rocm)

Red Hat AI Inference Server 3.2.2 rocm is now available. Red Hat® AI Inference Server...

Important: Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (cuda)

Red Hat AI Inference Server 3.2.2 cuda is now available. Red Hat® AI Inference Server...

Important: Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)

Red Hat AI Inference Server Model Optimization Tools 3.2.2 CUDA is now available. Red Hat® AI Inference Server Model Optimization Tools...

Link Inference Attack on Privacy-Preserving Knowledge Graphs

Knowledge Graphs KGs are widely used to store and share structured information across sensitive domains such as healthcare, fi- nance, and social networks. A common privacy practice is to delete sen- sitive relations before publishing the graph, under the assumption that removing edges is...

CVE-2026-103270: Missing Authentication for Critical Function

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

PT-2026-103286

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause generation, /abort request, /flush cache, and /init weights update group to disrupt inference operations and wedge...

Deep Learning Latency Attacks and Defenses: A Cross-Domain Survey of Availability Threats

Adversarial machine learning has focused mainly on integrity, but availability is an increasingly consequential complement. Latency attacks also energy-latency attacks increase inference-time work, energy, or response time, causing deadline misses, throughput collapse, or resource exhaustion in...

GAZEleak: Passcode Inference against Eye-Tracking XR Devices through External Observation

Mixed-reality headsets such as Apple Vision Pro replace the touch screen with gaze-as-pointer interaction: the wearer looks at a target and confirms with an air pinch. Because the display is inside the headset and the eye tracker is walled off from third-party software, such input is widely assum...

Inference-Layer Security: Defending against Adversarial Inference and Infrastructure Abuse

A Technical Report: Operating a large language model LLM as a service requires more than inference infrastructure: the provider must also defend against adversarial interactions that seek to exploit the service, including jailbreaking for harmful use, sophisticated denial of service, and...

CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering

Indirect prompt injection makes an LLM agent treat untrusted retrieved text as instructions. We present CounterSteer, an inference-time defense that suppresses this behavior inside the model. Per model, a five-step recipe fits a residual-stream direction from paired episodes differing only in...

evoke-vllm (>=0.1.0, <=0.1.1), lazyllm-verl (0.3.2.dev1) +6 more potentially affected by CVE-2026-100653 via vllm (>=0.22.1, <=0.27.1)

vllm PYPI version =0.22.1, =0.1.0, =2.8.0, =2.2.2, =0.1.10, =0.1.0, =0.1.3 Source cves: CVE-2026-100653 Source advisory: SNYK:PYTHON-VLLM-20158365...

CVE-2026-100651

A flaw was found in vLLM. The service fails to properly enforce length limits on input prompts when handling certain multimodal inference requests. A remote attacker with access to the inference service could exploit this vulnerability by submitting an excessively long prompt, causing an internal...