vcenter_saml_login

Strumento di Accesso SAML per vCenter Uno strumento per estrarre il certificato dell'Identity Provider IdP dai backup di vCenter e accedere come Administrator Contesto Comunemente, durante gli engagement, otteniamo accesso ai backup di vCenter su un file server o accesso root all'host VCSA tramit...

CVE-2026-84276

IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

CVE-2026-84276

IBM Guardium Data Protection version 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller . An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion . This flaw ca...

EUVD-2026-95168

IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the...

PT-2026-108159

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2.2 Description A denial-of-service issue exists in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can send malformed task data. This...

bind security update

32:9.11.36-16.16 - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs CVE-2026-80274 - Reject oversized negative cached records early CVE-2026-19667...

Oracle Linux 9 : bind9.18 (ELSA-2026-75578)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-75578 advisory. - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent memory leak on following HTTPS/SVCB RR CVE-2026-81563 - Preve...

Oracle Linux 9 : bind (ELSA-2026-75767)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-75767 advisory. - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NSEC and NSEC3...

nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination

A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service...

CLEANSTART-2026-ZU18134 Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153)

Security vulnerability affects the sonarqube package. Reachable Assertion CWE-617 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153...

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the mirrored sender/receiver cache protocol reaches. Summary vLLM's default multimodal cache...

GHSA-PH3R-5JFG-F84F vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the mirrored sender/receiver cache protocol reaches. Summary vLLM's default multimodal cache...

PYSEC-2026-4197

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if...

CVE-2026-105753

The vLLM inference and serving engine is vulnerable to a shared-service availability failure in versions prior to 0.28.0 . The root cause is a desynchronization in the mirrored multimodal LRU cache ; if a request is rejected during multimodal rendering, the frontend sender cache commits a media h...

Astra Linux – Vulnerability in bind9

In BIND 9.0.0 - 9.11.29, 9.12.0 - 9.16.13, and versions BIND 9.9.3-S1 - 9.11.29-S1 and 9.16.8-S1 - 9.16.13-S1 of the Supported Preview Edition, as well as release versions 9.17.0 - 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record that...

Astra Linux – Vulnerability in nghttp2

nghttp2 is an implementation of the Hypertext Transfer Protocol Version 2 in C. Prior to version 1.68.1, the nghttp2 library would stop reading incoming data when the user-facing public API nghttp2sessionterminatesession or nghttp2sessionterminatesession2 was called by the application. These APIs...

Astra Linux – Vulnerability in Lasso

There is a denial-of-service vulnerability in the gassertnotreached functionality of Entr’ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial-of-service attack. An attacker can send a malformed SAML response to exploit this vulnerability...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: jbd2: The assertion “jh-bfrozendata == NULL” failed when the journal was aborted. The following process will fail the assertion “jh-bfrozendata == NULL” in jbd2journaldirtymetadata: jbd2journalcommitTransaction; unlinkdir/a; jh-b...

Astra Linux – Vulnerability in tinyxml

In the TiXmlDeclaration::Parse method in tinyxmlparser.cpp within TinyXML, up to version 2.6.2, there is a potentially exploitable assertion which can lead to application exit. This issue occurs when a malicious XML document is used, where a null character \0 is placed after a whitespace...