EUVD-2026-87743

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

CVE-2026-100649

Versions of vLLM prior to 0.29.0 are vulnerable to a resource-limit bypass within the PyNvVideoCodec decoder allocation. The root cause is sampler subclass shadowing , which allows for independent counter increments rather than global tracking. An unauthenticated remote attacker can exploit this ...

CVE-2026-14840

CVE-2026-14840 — YOP Poll 7.0.6 Bypass de Límite de Votos Autor: nullwhisper Uso: solo para investigación de seguridad autorizada / validación de vulnerabilidades. ¿Qué es esto? El plugin YOP Poll en versiones 7.0.6 aplica un límite de un voto por IP. El problema es que para obtener la IP del...

CVE-2026-100571

OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...

CVE-2026-100571 OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass

OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...

CVE-2026-100571

The OpenClaw npm package (openclaw) versions >= 2026.6.6 and

EUVD-2026-87480

OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...

CVE-2026-100571 OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass

OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...

CVE-2026-100542 OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2

OpenClaw npm package 'openclaw' versions = 2026.5.28 and 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained...

CVE-2026-100542 OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2

OpenClaw npm package 'openclaw' versions = 2026.5.28 and 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained...

CLEANSTART-2026-FL18888 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the loki package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

SUSE CVE-2026-98126

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOCFLZERORANGE is used without FALLOCFLKEEPSIZE, smb3zerorange may extend EOF without checking RLIMITFSIZE, allowing the file to grow beyond the caller's file-size limit. Fix th...

CVE-2026-67226

The RabbitMQ messaging and streaming broker is vulnerable to an admin-only atom exhaustion attack in versions 4.0.0 through 4.0.22, 4.1.14, and 4.2.7. The root cause lies in the PUT /api/users tags list endpoint, where the settags/2 function maps rabbitdatacoercion:toatom/1 over the user's tags l...

CVE-2026-98126

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOCFLZERORANGE is used without FALLOCFLKEEPSIZE, smb3zerorange may extend EOF without checking RLIMITFSIZE, allowing the file to grow beyond the caller's file-size limit. Fix th...

DEBIAN-CVE-2026-98126

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOCFLZERORANGE is used without FALLOCFLKEEPSIZE, smb3zerorange may extend EOF without checking RLIMITFSIZE, allowing the file to grow beyond the caller's file-size limit. Fix th...

AZL-104511 CVE-2026-98126 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOCFLZERORANGE is used without FALLOCFLKEEPSIZE, smb3zerorange may extend EOF without checking RLIMITFSIZE, allowing the file to grow beyond the caller's file-size limit. Fix th...

DEBIAN-CVE-2026-98113

In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages. Rate limit the message to...

CVE-2026-98113

In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages. Rate limit the message to...