Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the structuredoutputs.regex parameter in the lm-format-enforcer backend. An attacker can...

Malicious Package

Overview datetime-format-xutil is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-13936 Malicious code in datetime-format-xutil (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 677f98dffacde20a42bef500b1e5d3e3b4b27bdcd11d7d74aa398730d6643b24 The package advertises itself as a date-format utility but ships a postinstall.js that runs automatically via scripts.postinstall on npm install. The...

Malicious code in datetime-format-xutil (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 677f98dffacde20a42bef500b1e5d3e3b4b27bdcd11d7d74aa398730d6643b24 The package advertises itself as a date-format utility but ships a postinstall.js that runs automatically via scripts.postinstall on npm install. The...

CVE-2026-73556 vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structuredoutputs.regex parameter in vllm/v1/structuredoutput/backendlmformatenforcer.py is passed to lmformatenforcer.RegexParser without compileregexwithtimeout or validation in...

CVE-2026-73556

vLLM before 0.26.0 is affected by a DoS-like issue in the lm-format-enforcer backend: structured_outputs.regex is passed to RegexParser without compile_timeout or validation in validate_structured_output_request_lm_format_enforcer, allowing unauthenticated /v1/completions requests to consume CPU ...

CVE-2026-73556 vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structuredoutputs.regex parameter in vllm/v1/structuredoutput/backendlmformatenforcer.py is passed to lmformatenforcer.RegexParser without compileregexwithtimeout or validation in...

CVE-2026-73556 vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structuredoutputs.regex parameter in vllm/v1/structuredoutput/backendlmformatenforcer.py is passed to lmformatenforcer.RegexParser without compileregexwithtimeout or validation in...

CVE-2026-18408

Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-871...

PT-2026-71671

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.26.0 Description An unauthenticated request to the '/v1/completions' endpoint can cause a denial of service by consuming a CPU core and stalling the structured-output engine path. This occurs because the structured...

The vulnerability of the net/mlx5 component in the Linux operating system, which allows a hacker to cause a service failure.

The vulnerability of the net/mlx5 component in the Linux operating system is related to insufficient handling of format strings. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-12004

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and...

EUVD-2026-57541

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and...

CVE-2026-12004

CVE-2026-12004 is a format-string injection vulnerability in the IBM Security Verify Access management interface, affecting IBM Security Verify Access 10.0–10.0.9.2, IBM Verify Identity Access 11.0–11.0.3, and IBM Verify Identity Access Container 11.0–11.0.3. The issue can cause denial of service...

CVE-2026-12004

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and...

CVE-2026-12004 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and...

CVE-2026-12004 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and...

SUSE CVE-2026-59091

A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts witho...

JLSEC-2026-1265 GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by...

GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression...

Security update for gzip

This update for gzip fixes the following issues: CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state between different decompression formats within a single execution bsc1269623. crafted LZW file followed by a crafted LZH file can cau...