CVE-2026-93989 vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words

vLLM through 0.29.0 fails to properly validate badwords token indices against the model's generation output width in SamplingParams.updatefromtokenizer. Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests to...

Malicious code in radio-player-theme (npm)

radio-player-theme presents itself as a radio player theme. The published tarball contains three files: package.json, style.css declared as main and payload.js, which holds the package's only executable code. payload.js is a browser payload. On execution it reads location.origin and...

SUSE CVE-2026-93592

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

CVE-2026-93999

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...

CVE-2026-93999 Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...

CVE-2026-93999

Keycloak's OIDC token refresh process contains a flaw where the server restores requested audiences from stored client IDs but fails to verify whether the target audience client is still enabled before issuing a new access token. This allows an application holding an existing refresh token to con...

EUVD-2026-83600

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...

CVE-2026-93999 Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...

CVE-2026-93999

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...

CVE-2026-18346

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stor...

CVE-2026-9613

CVE-2026-9613 affects the Datalogics Ecommerce Delivery WordPress plugin in all versions up to and including 2.6.65 . The root cause is improper authorization verification in multiple AJAX actions (datalogics_create_shipping / datalogics_cancel_shipping), allowing authenticated users with subscri...

EUVD-2026-83569

The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

EUVD-2026-83563

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stor...

CVE-2026-18346

The TikTok for Business WordPress plugin (all versions up to 1.4.1 ) is vulnerable to authorization bypass via the auth_code parameter. The plugin fails to verify that the requester is authorized before processing a token exchange, allowing an unauthenticated attacker to overwrite the merchant's ...

[SECURITY] [DLA 4787-1] ruby-jwt security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4787-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA September 18, 2026 https://wiki.debian.org/LTS -...

CLEANSTART-2026-PZ14685 Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused

Security vulnerability affects the vault package. Vault and Vault Enterprise’s “Vault” login MFA rate limits could be bypassed and TOTP tokens could be reused...

EUVD-2026-83457

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of...

CVE-2026-93921

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of...

CVE-2026-93999: Missing Authorization

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...

PT-2026-95825

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the OpenID Connect OIDC protocol implementation. During the token refresh process, the server restores requested audiences from stored client IDs but fails to verify if the...