CVE-2026-115916

A flaw was found in vLLM. This vulnerability allows a remote attacker to cause a Denial of Service DoS by submitting a request containing an out-of-bounds pre-tokenized prompt token identifier. Due to an off-by-one error in input validation, an invalid token identifier equal to the vocabulary siz...

EUVD-2026-110483

libpff through 20260926 contains an off-by-one bounds check in libpfftableread6crecordentries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent...

Linux Distros Unpatched Vulnerability : CVE-2026-79981

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised dnsresolveinitlocked -...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146349)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146349 advisory. In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on buildskb failure qederxbuildskb and...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146151)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146151 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackirc: fix parsedcc off-by-one OOB read parsedcc treats dataend as an inclusi...

Linux Distros Unpatched Vulnerability : CVE-2026-79977

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handletransportdata, when the...

CVE-2026-116735

libpff through 20260926 contains an off-by-one bounds check in libpfftableread6crecordentries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent...

CVE-2026-116735

libpff through 20260926 contains an off-by-one bounds check in libpfftableread6crecordentries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent...

UBUNTU-CVE-2026-116735

libpff through 20260926 contains an off-by-one bounds check in libpfftableread6crecordentries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent...

CVE-2026-116735

libpff through 20260926 contains an off-by-one bounds check in libpfftableread6crecordentries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent...

Improper Validation of Array Index

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Validation of Array Index via an off-by-one error in getcachedtokenizer in vllm/tokenizers/hf.py, where vocabsize a count is used directly ...

PYSEC-2026-4347

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...

CVE-2026-115916

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...

PYSEC-2026-4347

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...

CVE-2026-115916

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...

DEBIAN-CVE-2026-99091

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix status of pending commands flushed on power off cmdcompletersp receives a struct cmdlookup and, for a pending command that has no cmdcomplete callback, falls through to cmdstatusrspcmd, data. cmdstatusrsp rea...

CVE-2026-99091 Bluetooth: MGMT: Fix status of pending commands flushed on power off

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix status of pending commands flushed on power off cmdcompletersp receives a struct cmdlookup and, for a pending command that has no cmdcomplete callback, falls through to cmdstatusrspcmd, data. cmdstatusrsp rea...

CVE-2026-99091 Bluetooth: MGMT: Fix status of pending commands flushed on power off

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix status of pending commands flushed on power off cmdcompletersp receives a struct cmdlookup and, for a pending command that has no cmdcomplete callback, falls through to cmdstatusrspcmd, data. cmdstatusrsp rea...

Libyal libpff numerical error vulnerability

Versions of libyal libpff prior to 20260926 contain a numerical error vulnerability. This vulnerability stems from an off-by-one boundary check in libpfftableread6crecordentries. Attackers can exploit specially crafted entries within the 6c table to trigger heap-based out-of-bounds reads. Providi...

PT-2026-123378

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix status of pending commands flushed on power off cmd complete rsp receives a struct cmd lookup and, for a pending command that has no cmd complete callback, falls through to cmd status rspcmd, data. cmd status...