CVE-2026-105742

A flaw was found in docling. This vulnerability can lead to information disclosure of sensitive credentials, such as API keys and session tokens. When remote image fetching is enabled, the HTML image loader fails to restrict custom request headers to the document's original domain. A remote...

CVE-2026-105755

A flaw was found in vLLM. When handling flash late-interaction scoring and reranking requests, internal cache keys are derived directly from user-supplied request identifiers. A remote attacker can exploit this issue by submitting concurrent requests reusing a victim's request identifier to...

CVE-2026-105756

A flaw was found in vllm. An authenticated remote attacker can cause a Denial of Service DoS by submitting an API request containing an invalid cache salt parameter with forbidden characters or excessive length. Because the application fails to validate the parameter before passing it to the...

CVE-2026-105753

A flaw was found in vLLM. This vulnerability allows a remote user to cause a Denial of Service DoS on the model serving engine. The issue occurs when a multimodal request is rejected after media processing, causing the frontend and backend caches to become desynchronized. A subsequent request...

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the mirrored sender/receiver cache protocol reaches. Summary vLLM's default multimodal cache...

PT-2026-106787

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions prior to 4.0.0-canary.34 Description A malformed multipart request body can cause the processing of the multipart Content-Type to take an excessive amount of time, leading to uncontrolled...

PT-2026-107234

Name of the Vulnerable Software and Affected Versions Apache log4net versions 1.2.11 through 3.4.x Description Improper handling of exceptional conditions in the aspnet-request pattern converter allows a sender to suppress the log record of their own request. When reading request parameters,...

Linux Distros Unpatched Vulnerability : CVE-2026-104042

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sssd. A local attacker can cause a Denial of Service DoS by sending a crafted Pluggable Authentication Module PAM request containing a...

Cisco ASA Improper Input Validation (CVE-2022-20924)

A vulnerability in the Simple Network Management Protocol SNMP feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerabili...

Next.js 15.5.6 Remote Code Execution

Next.js version 15.5.6 is affected by an unauthenticated remote code execution vulnerability in React Server Components request deserialization. This CTF deployment exposes a Server Action endpoint to demonstrate the issue...

PT-2026-107220

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea Actions incorrectly determined if a fork pull request run required approval by checking the user who triggered the event instead of the pull request author. When a maintainer performed...

PT-2026-106298

A flaw was found in sssd. A local attacker can trigger a Denial of Service DoS by sending a specially crafted Pluggable Authentication Module PAM request when passkey authentication is enabled. Due to a missing state validation check in passkey Kerberos handling, the PAM responder dereferences an...

CVE-2026-93319

A malicious external BuildKit frontend can send requests using the int...

Cisco ASA Out-of-bounds Write (CVE-2021-1445)

Multiple vulnerabilities in Cisco Adaptive Security Appliance ASA Software and Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. These vulnerabilities are due to lack of proper input validation o...

Cisco ASA Out-of-bounds Write (CVE-2021-1504)

Multiple vulnerabilities in Cisco Adaptive Security Appliance ASA Software and Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. These vulnerabilities are due to lack of proper input validation o...

Cisco ASA Buffer Copy without Checking Size of Input (CVE-2021-1493)

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to insufficient boundary checks...

Linux Distros Unpatched Vulnerability : CVE-2026-104044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sssd. A local attacker can trigger a Denial of Service DoS by sending a specially crafted Pluggable Authentication Module PAM request when...

Linux Distros Unpatched Vulnerability : CVE-2026-98228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respe...

Cisco ASA Exposure of Sensitive Information to an Unauthorized Actor (CVE-2020-3259)

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential...

nginx

CVE-2017-7529 Тан Сынпё @portfolio10 Краткое описание Данная лабораторная работа воспроизводит уязвимость кеша CVE-2017-7529, возникающую при обработке Range-запросов в сервере Nginx, и демонстрирует реальное поведение уязвимости. Уязвимость: ошибка обработки заголовка Range в Nginx, приводящая к...