NPM: undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

NPM: undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches vulnerability discovered by ? in WordPress Npm undici versions = 7.0.0, 7.29.1...

Uncontrolled Resource Consumption

Apache Struts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded growth of internal localized-text caches based on attacker-controlled locale values from incoming requests, which allows an unauthenticated remote attacker to exhaust the Java heap and cause a...

HTTP Request/response Smuggling

Http4s is vulnerable to HTTP request/response smuggling. The vulnerability is due to Ember’s chunk decoder accepting malformed chunk-size values with leading plus or minus signs, which allows an attacker to exploit differences in chunk-boundary parsing by intermediaries to bypass controls, poison...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm/slabcommon: The corruption of the slabcaches list after kmemcacheDestroy has been fixed. After the commit in “Fixes”, if a module that creates a slab cache does not release all of its allocated objects before destroying the...

CVE-2026-80434 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference...

CVE-2026-80434 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference...

CVE-2026-84663: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches...

PT-2026-84786

A cross-site request forgery CSRF vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches...

SUSE CVE-2026-68428

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmudestroycaches destroys ptelistdesccache and mmupageheadercache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor modu...

CVE-2026-68428

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmudestroycaches destroys ptelistdesccache and mmupageheadercache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor modu...

PT-2026-69828

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.1.3 Description A slab use-after-free issue exists in the KVM x86 MMU. The mmu destroy caches function destroys pte list desc cache and mmu page header cache but fails to clear the associated pointers. Because these...

CVE-2026-61808

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...

EUVD-2026-54644

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...

CVE-2026-61808 LightRAG: Missing Authentication for Critical API Functions in Default Configuration

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...

CVE-2026-61808

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...

CVE-2026-61808

CVE-2026-61808 affects LightRAG up to version 1.5.4, where the API server binds to all network interfaces with authentication disabled by default. This allows an unauthenticated network attacker to read indexed documents, upload or delete documents, modify the knowledge graph, cancel pipelines, c...

CVE-2026-61808 LightRAG: Missing Authentication for Critical API Functions in Default Configuration

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...

Information Disclosure

undici is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper parsing of whitespace around qualified Cache-Control directives, causing authenticated responses to be incorrectly stored in shared caches and potentially served to unauthorized users...

CVE-2026-71281 peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...

PT-2026-67089

Name of the Vulnerable Software and Affected Versions LWS Optimize versions prior to 3.4 Description The LWS Optimize WordPress plugin fails to perform a capability check on its cache-clearing actions. This allows any authenticated user, including those with Subscriber privileges, to flush the si...