CLEANSTART-2026-VD99251 flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input

Security vulnerability affects the sonarqube package. A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input...

CLEANSTART-2026-XK97843 HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023

Security vulnerability affects the go package. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

CLEANSTART-2026-IY13000 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Security vulnerability affects the rundeck package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...

CLEANSTART-2026-CI58129 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request

Security vulnerability affects the rundeck package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...

CVE-2026-105742

A flaw was found in docling. This vulnerability can lead to information disclosure of sensitive credentials, such as API keys and session tokens. When remote image fetching is enabled, the HTML image loader fails to restrict custom request headers to the document's original domain. A remote...

CVE-2026-105756

A flaw was found in vllm. An authenticated remote attacker can cause a Denial of Service DoS by submitting an API request containing an invalid cache salt parameter with forbidden characters or excessive length. Because the application fails to validate the parameter before passing it to the...

CVE-2026-105755

A flaw was found in vLLM. When handling flash late-interaction scoring and reranking requests, internal cache keys are derived directly from user-supplied request identifiers. A remote attacker can exploit this issue by submitting concurrent requests reusing a victim's request identifier to...

CVE-2026-105753

A flaw was found in vLLM. This vulnerability allows a remote user to cause a Denial of Service DoS on the model serving engine. The issue occurs when a multimodal request is rejected after media processing, causing the frontend and backend caches to become desynchronized. A subsequent request...

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the mirrored sender/receiver cache protocol reaches. Summary vLLM's default multimodal cache...

CVE-2026-95140

kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create...

PT-2026-107111

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

PT-2026-106891

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 155.0.8059.39 Description A cross-site request forgery issue in ReadingList allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or...

PT-2026-107176

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A flaw in Gitea Actions allows workflow code from first-time fork pull request contributors to execute on repository runners without required maintainer approval. This occurs because the rerun...

CVE-2026-102158: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

CVE-2026-106486: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate...

CVE-2026-104632: Improper Authorization

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access...

PT-2026-106581

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A refcount bug exists in the RDMA/core component within the iwpm get nlmsg request function. The function initializes the refcount after calling list add tail, which makes the object...

Linux Distros Unpatched Vulnerability : CVE-2026-104042

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sssd. A local attacker can cause a Denial of Service DoS by sending a crafted Pluggable Authentication Module PAM request containing a...

Cisco ASA Improper Input Validation (CVE-2022-20924)

A vulnerability in the Simple Network Management Protocol SNMP feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerabili...

PT-2026-106296

A flaw was found in sssd. A local attacker can cause a Denial of Service DoS by sending a crafted Pluggable Authentication Module PAM request containing a zero-length authentication token to the responder socket. Due to missing input validation, the service attempts to read beyond buffer boundari...