PT-2026-106324

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.31.1 Description A remote out-of-bounds read can occur within the Completions Request Handler component. The issue resides in the conv ssm forward function located in the vllm/model executor/layers/mamba/mamba mixer2.p...

CVE-2026-104626: Improper Enforcement of Behavioral Workflow

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer...

PT-2026-115981

Summary Before Langflow 1.10.3, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses...

Cisco ASA Out-of-bounds Write (CVE-2021-1445)

Multiple vulnerabilities in Cisco Adaptive Security Appliance ASA Software and Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. These vulnerabilities are due to lack of proper input validation o...

Cisco ASA Out-of-bounds Write (CVE-2021-1504)

Multiple vulnerabilities in Cisco Adaptive Security Appliance ASA Software and Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. These vulnerabilities are due to lack of proper input validation o...

Linux Distros Unpatched Vulnerability : CVE-2026-104044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sssd. A local attacker can trigger a Denial of Service DoS by sending a specially crafted Pluggable Authentication Module PAM request when...

Cisco ASA Buffer Copy without Checking Size of Input (CVE-2021-1493)

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to insufficient boundary checks...

CVE-2026-103620: Missing Authorization

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

PT-2026-106298

Name of the Vulnerable Software and Affected Versions sssd affected versions not specified Description A flaw in sssd allows a local attacker to cause a Denial of Service DoS by sending a specially crafted Pluggable Authentication Module PAM request while passkey authentication is active. The iss...

CVE-2026-105775: Out-of-bounds Read

A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function convssmforward of the file vllm/modelexecutor/layers/mamba/mambamixer2.py of the component Completions Request Handler. The manipulation leads to out-of-bounds read. The attack is possible to b...

PT-2026-107175

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A flaw in Gitea Actions allows a user who can open a fork pull request to execute fork-controlled workflow code. By using a shared run-level concurrency group, an attacker can place workflow...

PT-2026-107132

Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations...

PT-2026-107131

Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations...

PT-2026-107172

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A flaw exists in Gitea Actions where older runs within the same workflow-level concurrency group are cancelled upon the insertion of a new run without verifying if the new run requires approval...

PT-2026-107153

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remot...

Cisco ASA Exposure of Sensitive Information to an Unauthorized Actor (CVE-2020-3259)

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential...

Linux Distros Unpatched Vulnerability : CVE-2026-98228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respe...

Linux Distros Unpatched Vulnerability : CVE-2026-98328

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported,...

PT-2026-107154

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent...

CVE-2026-106038: Missing Authentication for Critical Function

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the cororpc port. Attackers can send forged requests with the force flag set to bypas...