EUVD-2026-107421

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those...

CVE-2026-114051

A flaw was found in vllm. A remote attacker can cause a Denial of Service DoS by sending a specially crafted inference request containing an oversized minimum token parameter and an omitted maximum token parameter. Due to improper input validation, this request triggers an unhandled exception tha...

CVE-2026-80743

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture System on Chip ASoC xilinx formatterpcm component. This vulnerability arises when interrupt request IRQ handlers attempt to access driver data before it has been fully initialized during device setup. An interrupt occurring ...

CVE-2026-76487

A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improp...

CVE-2026-113796

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...

Exploit for CVE-2026-109618

PHP CVE-2026-109618 / CVE-2026-109619 — DoS Attack Toolkit...

SUSE CVE-2026-101356

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

EUVD-2026-105128

Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine...

CVE-2026-114470

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...

DEBIAN-CVE-2026-102483

Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields...

CVE-2026-102483

Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields...

CVE-2026-76487

A vulnerability exists in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) . The flaw stems from improper input validation for specific HTTP requests, which could allow an unauthenticated, remote attacker to per...

CVE-2026-76487 Cisco Unified Communications Manager Improper Access Control Vulnerability

A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improp...

EUVD-2026-107348

A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improp...

CVE-2026-113798

The Electron framework is vulnerable to an Origin Validation Error (CWE-346) in versions prior to 42.11.9 , 43.7.6 , 44.5.0 , and 45.0.0-alpha.13 . The root cause is that pointerLock permission requests from certain cross-origin iframes incorrectly cause session.setPermissionRequestHandler() to r...

CVE-2026-113796 Electron: SameSite cookie restrictions are not applied to windows opened from links

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...

CVE-2026-113796

The Electron framework (prior to versions 42.11.3 , 43.7.0 , 44.3.0 , and 45.0.0-alpha.6 ) fails to correctly apply SameSite cookie restrictions when opening new windows via links. The framework incorrectly treats these as application-initiated navigations rather than preserving the initiating pa...

CVE-2026-113796 Electron: SameSite cookie restrictions are not applied to windows opened from links

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...

Exploit for CVE-2026-109618

php2shell-check Check in about a minute whether a server is a...

php: OOM bailout during request parsing leads to memory corruption and RCE

A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the...