ROS-20260928-73-0111

The vulnerability of the topologyparsecpucapacity function in the drivers/base/archtopology.c file of the Linux kernel is related to pointer arithmetic errors. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of services for the NFS ONCRPC XDR operating system allows a hacker to trigger a service failure.

The vulnerability of services for the NFS ONCRPC XDR operating system lies in reading data beyond the allowed range of memory. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) – a system for controlling access to virtual environments – stems from insufficient validation of input data. This allows attackers to execute arbitrary code or trigger service failures.

The vulnerability of the NetScaler ADC application delivery controller previously Citrix ADC and the NetScaler Gateway virtual environment access control system previously Citrix Gateway is related to operations that go beyond the buffer in memory. Exploiting this vulnerability could allow a...

ROS-20260928-73-0116

The vulnerability of the drmgemresetshadowplane function in the drivers/gpu/drm/drmgematomichelper.c file of the Direct Rendering Infrastructure DRI driver in the Linux operating system is related to the assignment of pointers. Exploiting this vulnerability could allow an attacker to cause a...

ROS-20260928-73-0027

The vulnerability of the tlsstrpmsghold function in the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the PHP interpreter, related to the assignment of the null pointer, allows attackers to trigger a service failure.

The vulnerability of the PHP interpreter is related to pointer operations. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

CVE-2026-101909: Improperly Controlled Modification of Object Prototype Attributes

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

ROS-20260928-73-0028

The vulnerability of the pidnrns function in the Linux operating system’s kernel is related to an error in pointer arithmetic. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-94418

WolfSSL is vulnerable to a cryptographic signature verification bypass when the WOLFSSL_SMALL_CERT_VERIFY option is enabled. The ProcessPeerCertParse() function separates signature checks from parsing to save memory but fails to merge the signature result if a parse error occurs, effectively hidi...

CVE-2026-94418 Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY

Under WOLFSSLSMALLCERTVERIFY, ProcessPeerCertParse runs the certificate signature check separately from the parse to keep peak memory down, then merges the two results, but it merged the signature result back only when the parse returned 0, so any parse error hid it. ParseCertRelative reaches its...

CVE-2026-94418 Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY

Under WOLFSSLSMALLCERTVERIFY, ProcessPeerCertParse runs the certificate signature check separately from the parse to keep peak memory down, then merges the two results, but it merged the signature result back only when the parse returned 0, so any parse error hid it. ParseCertRelative reaches its...

CVE-2026-94418 Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY

Under WOLFSSLSMALLCERTVERIFY, ProcessPeerCertParse runs the certificate signature check separately from the parse to keep peak memory down, then merges the two results, but it merged the signature result back only when the parse returned 0, so any parse error hid it. ParseCertRelative reaches its...

MGASA-2026-0456 Updated libreswan package fixes a security vulnerability

FIPS mode assertion failure via malicious CERT payload. CVE-2026-14957...

Updated libreswan package fixes a security vulnerability

FIPS mode assertion failure via malicious CERT payload. CVE-2026-14957...

CVE-2025-71424: Protection Mechanism Failure

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...

Improper Check for Unusual or Exceptional Conditions

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the disaggregated serving endpoint /inference/v1/generate in...

CVE-2026-100653

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin --revision / --code-revision is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the...

CVE-2026-100652

vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...

CVE-2026-100652

A flaw was found in vLLM. A remote attacker can trigger a Denial of Service DoS by sending requests containing stop token identifiers that exceed the supported vocabulary limits. Because the application's service frontends fail to properly validate these identifiers before internal processing, th...

CVE-2026-100653

The vLLM inference engine (versions 0.22.1 through 0.28.0) contains a supply-chain integrity and reproducibility failure. The system fails to propagate operator-supplied model revision pins (--revision / --code-revision) to specific Hugging Face artifacts for the FunAudioChat and Tarsier2 archite...