CVE-2026-93839 LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pdregister WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket...

PT-2026-95638

Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1 Description An authentication bypass exists in the /pd register WebSocket endpoint. Unauthenticated attackers can register arbitrary nodes by providing crafted JSON, as the system fails to perform peer address...

Cleartext Storage of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information through the clusterregistrationtoken API/store paths, pkg/capr/planner/agent.go, pkg/provisioningv2/prebootstrap/resolve.go, and pkg/controllers/capr/managesystemagent/managesystemagent.go. An...

Cleartext Storage of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information through the clusterregistrationtoken API/store paths, pkg/capr/planner/agent.go, pkg/provisioningv2/prebootstrap/resolve.go, and pkg/controllers/capr/managesystemagent/managesystemagent.go. An...

CVE-2026-55997 Long-lived Rancher registration token exposed in plaintext

Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on...

PT-2026-68063

Name of the Vulnerable Software and Affected Versions Rancher affected versions not specified Description Registration tokens used to authenticate nodes and agents joining a downstream cluster are issued without expiration and stored in plaintext. This allows an unauthorized user to obtain a toke...

CVE-2026-55997: Cleartext Storage of Sensitive Information

Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on...

EUVD-2026-32299

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the total number of nodes Currently, the nameserver doesn't limit the number of nodes it handles. This can be an attack vector if a malicious client starts registering random nodes, leading to memory...

HashiCorp Boundary 安全漏洞

HashiCorp Boundary is an open-source solution developed by HashiCorp in the United States. It enables secure, identity-based access for users across different environments to hosts and services. There are security vulnerabilities in versions of HashiCorp Boundary prior to 0.21.3, 0.20.3, and...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989442)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989442 advisory. In the Linux kernel, the following vulnerability has been resolved: drivers/base/node.c: fix compaction sysfs file leak Compaction sysfs file is created via...

DEBIAN-CVE-2022-49442

In the Linux kernel, the following vulnerability has been resolved: drivers/base/node.c: fix compaction sysfs file leak Compaction sysfs file is created via compactionregisternode in registernode. But we forgot to remove it in unregisternode. Thus compaction sysfs file is leaked. Using...