CVE-2026-37237

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read without enforcing a maximum response...

CVE-2026-37237

The vLLM library (up to and including version 0.17.0 ) is vulnerable to a Denial of Service (DoS) via memory exhaustion. The root cause lies in the AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions within multimodal/inputs.py. These functions utilize the aiohttp library to fetch use...

CVE-2026-77341: Improper Neutralization of CRLF Sequences

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP respons...

CVE-2026-54085: Improper Neutralization of Argument Delimiters in a Command

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing...

CVE-2026-37237

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read without enforcing a maximum response...

PT-2026-82935

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read occurs in the wcn36xx wifi driver when processing a short trigger BA firmware response. The system only validates the response length against the size of the respon...

PT-2026-83062

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description When IMAP compression is enabled, the compression state is reused across responses in a session. This causes response sizes to depend on both attacker-supplied mail and other mail within the same...

PT-2026-83068

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker with valid credentials can send an invalid IMAP URLFETCH command, causing the system to include uninitialized memory in the error response returned to the client. This can lead to the...

Linux Distros Unpatched Vulnerability : CVE-2026-80635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeofrsp 20 bytes, but when candidatec...

Linux Distros Unpatched Vulnerability : CVE-2026-77341

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly...

GHSA-VXJ7-4XRP-5VR4 aiosmtplib: STARTTLS response injection

Impact When a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately performs the TLS handshake without discarding any data still sitting in the receive buffer. Bytes the protocol read off the plaintext socket before the handshake survive across the...

aiosmtplib: STARTTLS response injection

Impact When a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately performs the TLS handshake without discarding any data still sitting in the receive buffer. Bytes the protocol read off the plaintext socket before the handshake survive across the...

EUVD-2026-63376

aiosmtplib: STARTTLS response injection...

CVE-2026-54084 Wazuh agent enrollment NULL pointer dereference via malformed manager response

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key response with fewer...

EUVD-2026-67307

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key response with fewer...

CVE-2026-54084 Wazuh agent enrollment NULL pointer dereference via malformed manager response

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key response with fewer...

CVE-2026-54084

Wazuh versions 4.0.0 through 4.14.6 are susceptible to a NULL pointer dereference in the w_enrollment_process_agent_key() routine during agent enrollment. When a rogue or man-in-the-middle manager returns a malformed key with fewer than four space-separated fields, OS_StrBreak() leaves the missin...

CVE-2026-54084 Wazuh agent enrollment NULL pointer dereference via malformed manager response

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key response with fewer...

CVE-2026-54085

Wazuh (open-source XDR/SIEM platform), versions 4.2.0 through 4.14.6 , contains missing input validation in multiple active response scripts that pass attacker-influenced alert fields to privileged system commands running as root. Five scripts (route-null.c, netsh.c, pf.c, npf.c, ipfw.c ) omit th...

CVE-2026-54085 Wazuh: Missing input validation in multiple active response scripts allows argument injection

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing...