CVE-2026-105752

A flaw was found in vLLM. When multi-turn requests using tool continuations are processed, the service fails to retain the cache salt parameter, causing cached data to be placed in a shared, unsalted cache namespace rather than an isolated tenant cache. An authenticated tenant with knowledge of a...

CVE-2026-105756

A flaw was found in vllm. An authenticated remote attacker can cause a Denial of Service DoS by submitting an API request containing an invalid cache salt parameter with forbidden characters or excessive length. Because the application fails to validate the parameter before passing it to the...

PT-2026-106266

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.30.0 Description vLLM is an inference and serving engine for large language models. OpenAI-compatible request models accept a cache salt value without enforcing the character and length restrictions required by the...

CVE-2026-97469

A flaw was found in PostgreSQL Anonymizer. An authenticated, unprivileged masked user can bypass access restrictions to execute restricted functions by embedding function calls within a subquery. By repeatedly invoking functions such as anon.hash, an attacker can collect output to deduce the...

CVE-2026-82380

Cross-Site Request Forgery CSRF in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a...

EUVD-2026-88141

Cross-Site Request Forgery CSRF in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a...

CVE-2026-82380 Apache Roller: CSRF protection bypass via self-generated salt validation

Cross-Site Request Forgery CSRF in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a...

CVE-2026-82380 Apache Roller: CSRF protection bypass via self-generated salt validation

Cross-Site Request Forgery CSRF in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a...

CVE-2026-82380

A Cross-Site Request Forgery (CSRF) vulnerability exists in Apache Roller 6.1.5 . The flaw is caused by CSRF validation filters incorrectly accepting requests that lack a required salt token , instead validating against a value the server itself generated for the request. This allows a remote att...

CVE-2026-82380 Apache Roller: CSRF protection bypass via self-generated salt validation

Cross-Site Request Forgery CSRF in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a...

PT-2026-99800

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5 Description Cross-Site Request Forgery CSRF occurs when the CSRF validation filters accept requests that omit the required salt token, instead validating against a value generated by the server for that request. Thi...

PT-2026-99318

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.0 Description A denial-of-service issue exists in OpenAI-compatible and Anthropic API endpoints. The cache salt parameter lacks maximum length validation and is processed on the single EngineCore scheduler thread...

CVE-2026-97469

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-97469 PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

EUVD-2026-87134

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-97469 PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-97469

PostgreSQL Anonymizer contains a vulnerability allowing authenticated, unprivileged masked users to bypass access restrictions by embedding function calls within a subquery . This allows the execution of RESTRICTED functions, such as anon.hash() . An attacker can repeatedly invoke these functions...

CVE-2026-97469 PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

PT-2026-98889

Name of the Vulnerable Software and Affected Versions PostgreSQL Anonymizer versions prior to 3.2.3 Description Unprivileged masked users can repeatedly call the anon.hash function to collect seed and hash output pairs. This allows for an offline brute-force attack to deduce the salt. Additionall...

CVE-2026-97469: Use of Weak Hash

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...