91217 matches found
PT-2026-95825
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the OpenID Connect OIDC protocol implementation. During the token refresh process, the server restores requested audiences from stored client IDs but fails to verify if the...
PT-2026-102786
vLLM through 0.29.0 fails to properly validate bad words token indices against the model's generation output width in SamplingParams.update from tokenizer. Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests...
PT-2026-95801
Name of the Vulnerable Software and Affected Versions TikTok plugin for WordPress versions prior to 1.4.2 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to overwrite...
Linux Distros Unpatched Vulnerability : CVE-2026-86049
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer...
CVE-2026-93989: Improper Validation of Array Index
vLLM through 0.29.0 fails to properly validate badwords token indices against the model's generation output width in SamplingParams.updatefromtokenizer. Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests to...
PT-2026-95873
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.1 Description The software fails to properly validate bad words token indices against the model's generation output width within the SamplingParams.update from tokenizer function. This allows attackers to provide...
Linux Distros Unpatched Vulnerability : CVE-2026-93574
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size...
CVE-2026-93999: Missing Authorization
A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...
DEBIAN-CVE-2026-93574
A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...
CVE-2026-93574
A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...
CVE-2026-93574
A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...
UBUNTU-CVE-2026-93574
A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...
CVE-2026-93868
Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...
CVE-2026-93870
Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users...
EUVD-2026-83385
A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...
CVE-2026-93574
A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...
CVE-2026-93873
Cotonti CMS through version 1.0.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability in the contact plugin's submission handler (plugins/contact/contact.php). The root cause is a failure to validate anti-CSRF tokens, allowing attackers to auto-submit contact forms from attacker-cont...
EUVD-2026-83370
Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox...
CVE-2026-93868
Cotonti through 1.0.0 uses md5(microtime()) to generate password recovery validation tokens in users.passrecover.php, yielding a predictable token space of roughly one million values per second. An unauthenticated attacker can read the server Date header, precompute candidate tokens within a narr...