CVE-2026-94627

A flaw was found in vLLM. A remote attacker can exploit a vulnerability in the Mooncake connector's management of GPU Key-Value KV cache block ownership. By submitting completion requests with multiple prompts that share a single transfer ID, attackers can cause orphaned KV cache blocks to...

io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

USN-8728-2: Linux kernel (Azure) vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

WordPress LiteSpeed Cache plugin <= 7.9 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by mak3bread in WordPress Plugin LiteSpeed Cache versions = 7.9...

WordPress WPGraphQL Smart Cache plugin < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting vulnerability

Unauthenticated Persisted Query Registration and Alias Squatting vulnerability discovered by msfire in WordPress Plugin WPGraphQL Smart Cache versions 2.3.2...

AZL-103425 CVE-2026-68956 affecting package erlang 26.2.5.21-6

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of sshconnection:handlemsg/4 checks only...

HTTP Request Smuggling

Http4s is vulnerable to HTTP request smuggling. The vulnerability is due to case-sensitive and charset-dependent parsing of the Transfer-Encoding header in Ember, which allows an attacker to exploit discrepancies between Ember and RFC-compliant intermediaries to bypass access controls, hijack...

CVE-2026-4123

The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the togglecache function which is hooked to the wpajaxtogglecache AJAX action. The function also lacks nonce...

CVE-2026-4123 RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action

The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the togglecache function which is hooked to the wpajaxtogglecache AJAX action. The function also lacks nonce...

CVE-2026-4123 RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action

The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the togglecache function which is hooked to the wpajaxtogglecache AJAX action. The function also lacks nonce...

unbound security update

An update is available for unbound. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The unbound packages provide a validating, recursive, and caching DNS or DNSS...

RLSA-2026:69120 Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

K000163363: Linux kernel vulnerability CVE-2026-43503

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers pskbcopyfclone and skbshift fail to propagate the SKBFLSHAREDFRAG bit in skbshinfo-flags when moving...

EUVD-2026-84221

vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts,...

PT-2026-96846

Name of the Vulnerable Software and Affected Versions Netdata versions prior to 2.10.4 Description An authenticated child agent can send an oversized CHART SLOT value that is processed by the str2ull encoded function and passed to pluginsd rrdset cache put to slot in src/plugins.d/pluginsd...

Logic flaw in Brocade SANnav Java cache key handling object comparison handling

A logic flaw in Brocade SANnav Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and...

PT-2026-96664

Name of the Vulnerable Software and Affected Versions RW Elephant Rental Inventory versions prior to 2.3.14 Description The plugin contains a missing authorization flaw. The toggle cache function, which is linked to the wp ajax toggle cache AJAX action, does not perform a capability check or nonc...

PT-2026-96689

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 27.3.4.17 Erlang/OTP versions 28.0 through 28.5.0.6 Erlang/OTP versions 29.0 through 29.1.0 ssh versions 3.0.1 through 5.2.11.12 ssh versions 5.3.0 through 5.5.2.5 ssh versions 6.0.0 through 6.0.5 Description A...

Linux Distros Unpatched Vulnerability : CVE-2026-76151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds read buffer over-read in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0...

RockyLinux 8 : unbound (RLSA-2026:69120)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:69120 advisory. unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 Tenable has extracted the preceding description block directly from the...