CVE-2026-115373

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/uuid that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve...

CVE-2026-115373

The container management platform Incus is vulnerable to a missing authorization flaw in the GET /1.0/operations/{uuid} endpoint. Affected versions include versions before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0. This vulnerability allows project-restricted clients to access operations ...

CVE-2026-115373

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/uuid that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve...

CVE-2026-115373 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/uuid that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve...

CVE-2026-115373 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/uuid that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve...

CVE-2026-115373

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/uuid that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve...

EUVD-2026-108296

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/uuid that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve...

CVE-2026-115373 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/uuid that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve...

LXC Incus authorization issue vulnerability

Versions prior to LXC Incus 6.0.7, from 6.1.0 up to versions prior to 7.0.2, and from 7.1.0 up to versions prior to 7.5.0 contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks on GET /1.0/operations/uuid. It may allow clients with restricted...

PT-2026-121551

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/uuid that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve...

CVE-2026-93856

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the...

CVE-2026-93856

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the...

CVE-2026-93856

In OpenStack Cinder (through version 29.0.0 ), a flaw in the Messages API allows for cross-project information disclosure . An authenticated non-admin user with project-scoped 'member' or 'reader' roles can use the Block Storage API v3.3 "List messages" call to retrieve non-expired messages belon...

CVE-2026-93856

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the...

Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p92p-rxj5-7p2x. This link is maintained to preserve external references. Original Description vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cac...

GHSA-HFWF-HGVP-4RR8 Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p92p-rxj5-7p2x. This link is maintained to preserve external references. Original Description vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cac...

Insufficient Verification of Data Authenticity

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via a forged client-supplied uuid field in multimodal content parts, which vLLM uses verbatim as the...

CVE-2026-114050

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving...

CVE-2026-114050 vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving...

CVE-2026-114050 vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving...