PT-2026-77289

The Sierra Wireless HL7800 cellular modem driver drivers/modem/vendor standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier parses AT responses with roughly twenty handlers that call net buf linearizevalue, sizeofvalue, buf, 0, len into a 128-byte stack buffer and then writ...

PT-2026-80442

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle in github.com/seaweedfs/seaweedfs...

PT-2026-80431

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool in github.com/traefik/traefik...

AlmaLinux 9 : haproxy (ALSA-2026:55772)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:55772 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow in...

RHEL 10 : haproxy (RHSA-2026:55679)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:55679 advisory. The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes:...

RHEL 9 : haproxy (RHSA-2026:55772)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:55772 advisory. The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haprox...

RockyLinux 9 : haproxy (RLSA-2026:55772)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55772 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow in...

AlmaLinux 10 : haproxy (ALSA-2026:55679)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:55679 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow in...

AlmaLinux 8 : nghttp2 (ALSA-2026:55804)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:55804 advisory. nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 Tenable has extracted the...

RHEL 8 : nghttp2 (RHSA-2026:55804)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:55804 advisory. libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: nghttp2: HTTP...

RockyLinux 8 : nghttp2 (RLSA-2026:55804)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:55804 advisory. nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 Tenable has extracted the...

RockyLinux 10 : haproxy (RLSA-2026:55679)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55679 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow in...

CVE-2026-64849

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/id/test endpoint calls validatewebhookurl in mlflow/utils/validation.py only for the original U...

CVE-2026-71486

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generateresponses, choices, tokenids, promptlogprobs, logprobs.content, toplogprobs, a...

CVE-2026-71486

In vLLM versions prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints process caller-supplied GenerateResponse objects via OnlineDerenderer and tokenizer.decode before enforcing max_model_len, max_tokens, max_num_seqs, or response-size limits. An authenticated...

CVE-2026-71486

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generateresponses, choices, tokenids, promptlogprobs, logprobs.content, toplogprobs, a...

ANT-2026-2BX2DMM1 · OpenSC · Stack Buffer Overflow

stack-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-2BX2DMM1: Stack buffer overflow in...

haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling

A flaw was found in HAProxy. A malicious FastCGI Fast Common Gateway Interface backend can exploit an integer overflow vulnerability in the fcgiconn structure's drl field. This occurs when specific contentLength and paddingLength values cause the drl field to wrap to zero, leading to incorrect...

Important: Red Hat Security Advisory: haproxy security update

An update for haproxy is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...