CVE-2026-105753

A flaw was found in vLLM. This vulnerability allows a remote user to cause a Denial of Service DoS on the model serving engine. The issue occurs when a multimodal request is rejected after media processing, causing the frontend and backend caches to become desynchronized. A subsequent request...

GHSA-PH3R-5JFG-F84F vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the mirrored sender/receiver cache protocol reaches. Summary vLLM's default multimodal cache...

EUVD-2026-92843

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core...

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the mirrored sender/receiver cache protocol reaches. Summary vLLM's default multimodal cache...

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the tool-continuation re-submission has omitted the salt. Summary On the GPT-OSS "Harmony" path POST...

GHSA-935W-9G4M-P28P vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the tool-continuation re-submission has omitted the salt. Summary On the GPT-OSS "Harmony" path POST...

PT-2026-106690

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMM PFN WRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxe check pagefault and left only HMM PFN VALID. A page...

RHEL 8 : Red Hat Single Sign-On 7.6.13 security update on RHEL 8 (Important) (RHSA-2026:76129)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76129 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

RHEL 9 : Red Hat Single Sign-On 7.6.13 security update on RHEL 9 (Important) (RHSA-2026:76130)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76130 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

RHEL 7 : Red Hat Single Sign-On 7.6.13 security update on RHEL 7 (Important) (RHSA-2026:76128)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76128 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

CVE-2026-106038: Missing Authentication for Critical Function

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the cororpc port. Attackers can send forged requests with the force flag set to bypas...

PT-2026-106439

Subscriber Denial of Service Attack in WPBase Cache = 5.5.6 versions...

Apache Commons JCS 3.2.1 Unauthenticated Java Deserialization

Summary JCS is a distributed caching system written in Java. It is intended to speed up applications by providing a means to manage cached data of various dynamic natures. Like any caching system, JCS is most useful for high read, low put applications. Latency times drop sharply and bottlenecks...

PT-2026-106742

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro rpc port. Attackers can send forged requests with the force flag set to bypa...

Linux Distros Unpatched Vulnerability : CVE-2026-93318

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised...

Linux Distros Unpatched Vulnerability : CVE-2026-77050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.translation.getsupportedlanguagevariant is subject to ...

PT-2026-106559

In the Linux kernel, the following vulnerability has been resolved: xfrm: use hlist del init rcu for state cache and state cache input Commit 14acf9652e56 "xfrm: defensively unhash xfrm state lists in xfrm state delete" converted bydst/bysrc/byseq/byspi from hlist del rcu to hlist del init rcu so...

PT-2026-106730

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.1.2 Django versions prior to 6.0.9 Django versions prior to 5.2.18 Description The django.utils.translation.get supported language variant function is susceptible to a denial-of-service attack. This occurs when the...

Linux Distros Unpatched Vulnerability : CVE-2026-104041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch NSS responder. Becau...

nginx

CVE-2017-7529 唐胜表@portfolio10 摘要 本实验重现了Nginx服务器在处理Range请求过程中发生的缓存漏洞CVE-2017-7529，并展示漏洞的实际行为 漏洞：由于Nginx对Range头处理错误，可能导致缓存数据暴露 影响：服务器缓存文件中的敏感数据泄露 环境配置与运行 操作系统：Windows 10 Docker, Python 1. 在特定目录下创建文件夹 2. 创建Dockerfile、poc.py、docker-compose.yml文件 3. 运行'docker compose up -d' 4...