CVE-2026-56300 Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions

Capgo before 12.128.2 contains unauthenticated security definer RPC functions getuserid and getorgpermforapikey that expose API key validity oracles and user UUID disclosure. Unauthenticated attackers using the public API key can validate leaked keys, enumerate users and apps, and determine...

A Lifecycle and Application-Stack Survey of Large Language Model Vulnerabilities: Attacks, Risks, Defenses, and Open Problems

Large language models are no longer only text generators. They are increasingly embedded in retrieval pipelines, enterprise assistants, coding environments, robotic systems, security-operation workflows, and autonomous agents that can read private data, call tools, write files, execute code, and...

Security Bulletin: NVIDIA Triton Inference Server - June 2026

NVIDIA has released a software update for NVIDIA® Triton Inference Server. To protect your system, clone or update this software to Triton Server r26.04 or later from the NVIDIA Triton Inference Server GitHub repo. Go to NVIDIA Product Security. Details The following table summarizes the potentia...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the SortingImpl.getValidSortingRules process. An attacker can infer the values of restricted fields by analyzing the order of rows returned through both JSON:API and GraphQL read paths. Remediation There is no...

CVE-2026-53923

A flaw was found in vLLM. Integer truncation of tensor dimensions in vLLM's GGUF dequantize kernels leads to partial tensor processing. This results in the output tensor retaining previously used GPU memory, which, in multi-tenant inference deployments, can expose sensitive tensor data from other...

airflow-provider-skypilot (0.1.3), autodistill-efficient-yolo-world (>=0.1.0, <=0.1.1) +27 more potentially affected by CVE-2026-13482 via skypilot (>=0.2.2, <=0.13.0)

skypilot PYPI version =0.2.2, =0.1.0, =0.1.2.dev0, =0.24.0, =0.1.1, =0.9.9, =0.9.9rc23, =0.9.9rc23, =0.9.9, =0.9.9, =1.0.2, =0.1.0, =0.1.6, =0.1.7 and more Source cves: CVE-2026-13482 Source advisory: SNYK:PYTHON-SKYPILOT-17675441...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Nvidia Triton_Inference_Server

CVE-2026-24207 / 24206 — NVIDIA Triton Inference Server SageMa...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Nvidia Triton_Inference_Server

CVE-2026-24207 / 24206 — NVIDIA Triton Inference Server SageMa...

Critical: Red Hat Security Advisory: Red Hat AI Inference Server 3.3.5 (CUDA)

Red Hat AI Inference Server 3.3.5 CUDA is now available. Red Hat® AI Inference Server...

Critical: Red Hat Security Advisory: Red Hat AI Inference Server 3.3.5 (ROCm)

Red Hat AI Inference Server 3.3.5 ROCm is now available. Red Hat® AI Inference Server...

Critical: Red Hat Security Advisory: Red Hat AI Inference Server 3.3.5 (Spyre)

Red Hat AI Inference Server 3.3.5 Spyre is now available. Red Hat® AI Inference Server...

Important: Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.3.5 (CUDA)

Red Hat AI Inference Server Model Optimization Tools 3.3.5 CUDA is now available. Red Hat® AI Inference Server Model Optimization Tools...

Your AI Cost Model Stops at the Token Price. The Bill Doesn't.

Your AI cost model stops at the token price, but the bill doesn't. Discover why almost 80% of production AI spend sits in inference and how to optimize your setup...

CVE-2026-54235

vLLM is an inference and serving engine for large language models LLMs. Prior to 0.23.1rc0, ll temperature validation gates use comparison operators , which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagat...

CVE-2026-53923

vLLM is an inference and serving engine for large language models LLMs. From 0.5.5 until 0.23.1rc0, integer truncation of tensor dimensions in vLLM's GGUF dequantize kernels csrc/quantization/gguf/ggufkernel.cu causes partial tensor processing. The output tensor is allocated at full size via...

CVE-2026-54235 vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

vLLM is an inference and serving engine for large language models LLMs. Prior to 0.23.1rc0, ll temperature validation gates use comparison operators , which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagat...

CITADEL: CSI-Based Jamming Detection and Open-Set Classification for IIoT Networks

Radio frequency jamming poses a critical threat to the availability of wireless Industrial Internet of Things IIoT networks. Existing detection and classification techniques are poorly suited to this setting: coarse signal-strength and cross-layer features lack information richness, while raw I/Q...

CVE-2026-53805

NVIDIA Spatial Intelligence Lab's SIL GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads without authentication or input validation...

CVE-2026-53805 NVIDIA SIL GEN3C Unauthenticated RCE via Pickle Deserialization in Inference API

NVIDIA Spatial Intelligence Lab's SIL GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads without authentication or input validation...

CVE-2026-53805

CVE-2026-53805 affects NVIDIA Spatial Intelligence Lab’s GEN3C. It describes an unauthenticated remote code execution vulnerability in the inference API server, exploitable via /request-inference and /seed-model endpoints that deserialize raw HTTP bodies with Python pickle.loads() without authent...