EUVD-2026-88465

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

CVE-2026-101909

A flaw was found in axios. In applications affected by prototype pollution, where an attacker can modify base JavaScript object properties, axios processes inherited options during form data serialization without verifying property ownership. An attacker can leverage this behavior to trigger a...

DEBIAN-CVE-2026-101909

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101909

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101909

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101909

The Axios promise-based HTTP client (versions 0.28.0 to 0.34.0 and 1.15.1 to 1.20.0 ) contains a Prototype Pollution Gadget in the toFormData options. The vulnerability exists because ToFormData processes inherited serialization options and visitor properties. This allows an attacker who has alre...

CVE-2026-100647

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cachesalt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP...

CVE-2026-100647 vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cachesalt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP...

EUVD-2026-87741

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cachesalt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP...

CVE-2026-100647 vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cachesalt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP...

CVE-2026-100647 vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cachesalt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP...

AZL-104762 CVE-2026-98078 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...

CVE-2026-98078 ipvs: fix reversed sequence option serialization

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...

CVE-2026-98078

The Linux kernel contains a vulnerability in the ipvs component related to incorrect sequence option serialization. The hton_seq() function expects host-order source and network-order destination arguments, but the version 1 sync sender passes these arguments in reverse. This flaw leaves 24 bytes...

CVE-2026-98078

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...

EUVD-2026-86828

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dashbitco lazyhtml allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. LazyHTML.tohtml/2 and LazyHTML.Tree.tohtml/2 decide whether to escape an element's text from i...

CVE-2026-97724

A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a proto property to modify the prototype of an object created during serialization in clonePlainJSObject in...

CVE-2026-97724

A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a proto property to modify the prototype of an object created during serialization in clonePlainJSObject in...

CVE-2026-97724

A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a proto property to modify the prototype of an object created during serialization in clonePlainJSObject in...

CVE-2026-97724

A prototype pollution vulnerability exists in Software Mansion React Native Worklets prior to version 0.12.2 . An attacker can provide a controlled object containing a proto property to modify the prototype of an object during serialization within the clonePlainJSObject function in packages/rea...