Important: Red Hat Security Advisory: Red Hat AI Inference 3.4.4 (spyre)

Red Hat AI Inference 3.4.4 spyre is now available. Red Hat AI Inference...

Moderate: Red Hat Security Advisory: Red Hat AI Inference Model Optimization Tools 3.4.4 (cuda)

Red Hat AI Inference Model Optimization Tools 3.4.4 cuda is now available. Red Hat AI Inference Model Optimization Tools...

Important: Red Hat Security Advisory: Red Hat AI Inference 3.4.4 (cpu)

Red Hat AI Inference 3.4.4 cpu is now available. Red Hat AI Inference...

Elasticsearch 8.19.x < 8.19.20 / 9.4.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-80 / ESA-2026-123)

The version of Elasticsearch installed on the remote host is 8.19.x prior to 8.19.20, or 9.4.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-80 and ESA-2026-123 advisories. - The native inference process that...

CVE-2026-47629

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful exploit might lead to denial of service...

CVE-2026-47627

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A successful exploit might lead to denial of service...

CVE-2026-47630

NVIDIA Triton Inference Server for Linux has an absolute path traversal vulnerability exploitable with low privileges locally, rated CVSS 5.5 (MEDIUM), potentially leading to code execution. No exploitation or patch details are provided; monitoring for updates is advised.

EUVD-2026-61111

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution...

CVE-2026-47629

Improper input validation in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to cause denial of service (CVSS 7.5 HIGH). No exploit details or patch version are provided; monitor NVIDIA's security advisory for updates.

CVE-2026-47627

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A successful exploit might lead to denial of service...

EUVD-2026-61107

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure...

CVE-2026-47606

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure...

CVE-2026-73560 vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformersutils/processors/mimov2omni.py passes attacker-controlled image and audio strings through fetchimage, requests.get, and Image.open instead of MediaConnector,...

SQL Injection

Spring Data Relational is vulnerable to SQL Injection. The vulnerability is due to insufficient escaping of wildcard characters in user-controlled input, which allows an attacker to inject wildcard patterns and perform boolean-based blind data inference...

CVE-2026-72642

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with th...

CVE-2026-72642

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with th...

EUVD-2026-58287

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with th...

CVE-2026-72642

The CVE notes a flaw in Elasticsearch’s native ML inference where a model operation computes a memory address from an offset without bounds checking, enabling heap corruption that can crash the inference process and potentially allow arbitrary code execution within that process. Affected configur...

CVE-2026-72642 Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with th...

CVE-2026-73558

vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x 2 d in activationkernels.cu can cause actandmulkernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or...