AlmaLinux 8 : ruby:2.5 (ALSA-2026:73519)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:73519 advisory. resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 rubygem-mongo: MongoDB Ruby Driver: Data...

PT-2026-106536

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the MMC-over-SPI systems where the mmc spi data do function updates the bytes xfered variable after each successfully transferred block. If a subsequent block in the same...

PT-2026-106555

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the memory management swap subsystem where the SWAP USAGE OFFLIST BIT flag collides with the actual usage count in the si-inuse pages counter. Because the flag is...

PT-2026-106592

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the ASOC codecs component specifically affecting the rt712-sdca-dmic. The stream config structure is not initialized before being passed to the sdw stream add slave...

PT-2026-106627

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the mmp pdma prep slave sg function within the dmaengine component. During the iteration of the scatterlist using for each sg, the entry length is incorrectly read from t...

PT-2026-106644

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS driver where ntfs non resident attr shrink calls runlist helpers that require the runlist write lock without actually holding it during the process of freeing...

jupyterreviewer (>=0.0.4, <=0.0.5), nepal-stock-price (1.0.0) +3 more potentially affected by CVE-2026-102598 via werkzeug (2.2.1)

werkzeug PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - jupyterreviewer =0.0.4, =0.8.3, =0.6.2, =0.6.16 Source cves: CVE-2026-102598 Source advisory: OSV:GHSA-G6X2-HCCM-HH4M...

chatterbot (>=0.2.4, <=0.2.5), monasca-agent (1.1.20) +2 more potentially affected by CVE-2026-96749 via pymongo (3.0.3)

pymongo PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - chatterbot =0.2.4, =0.1.0, =2.2.0 - robotoff 1.0.13 Source cves: CVE-2026-96749 Source advisory: OSV:GHSA-V4X9-3549-CRWV...

EUVD-2026-86347

PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters...

GHSA-PH72-CQR5-QPP7 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the scale-out transport path reaches. Summary vLLM's disaggregated scale-out transport splits a multimodal...

EUVD-2026-92844

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features...

EUVD-2026-75665

pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods...

chatterbot (>=0.2.4, <=0.2.5), monasca-agent (1.1.20) +2 more potentially affected by CVE-2026-88029 via pymongo (3.0.3)

pymongo PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - chatterbot =0.2.4, =0.1.0, =2.2.0 - robotoff 1.0.13 Source cves: CVE-2026-88029 Source advisory: OSV:GHSA-8FVV-FGR5-F8CH...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Improper Handling of Highly...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the...

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

GHSA-8FXW-FMJ8-XP7J MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

EUVD-2026-75637

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs...

CVE-2026-105786 Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in use...

CVE-2026-105761

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...