CVE-2026-93436 vLLM through 0.29.0 Memory Exhaustion via Rejected Requests

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with maxtokens=0 to exhaust decode-worker memory without bound until the worker restarts...

CVE-2026-54565

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, UR...

CVE-2026-54565 rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, UR...

EUVD-2026-82389

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. org.traccar.api.resource.GroupResource permits...

CVE-2026-52852

Traccar , an open-source GPS tracking system, is vulnerable to an uncontrolled infinite loop DoS prior to version 6.14.0 . An authenticated user with group-management and report permissions can create a cyclic group-parent hierarchy . The resource class GroupResource permits the cycle, while Attr...

CVE-2026-52852 Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. org.traccar.api.resource.GroupResource permits...

CVE-2026-54649

punchin-email is a Cloudflare Email Worker providing two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0 , the handleInbound handler delivers inbound alias mail via message.forward(), which silently drops the Reply-To header intended to route responses through the relay. W...

CVE-2026-54649 punchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...

CVE-2026-54649 punchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...

DEBIAN-CVE-2026-93099

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix UAF from worker threads when domains are removed The mbmhandleoverflow and cqmhandlelimbo workers read event counters and may sleep while doing so. They are scheduled via delayedwork embedded in struct...

DEBIAN-CVE-2026-93091

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Quiesce notifications before teardown scminotificationexit clears and releases the notification instance, but transport callbacks can still deliver incoming notifications until the TX/RX channels are freed...

AZL-102164 CVE-2026-90367 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking dev-mt76.mutex. mt76workerdisable/enable are plain kthread park/unpark, n...

EUVD-2026-82207

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix UAF from worker threads when domains are removed The mbmhandleoverflow and cqmhandlelimbo workers read event counters and may sleep while doing so. They are scheduled via delayedwork embedded in struct...

CVE-2026-93099

This CVE affects the Linux kernel fs/resctrl subsystem, specifically the Resource Director Technology (RDT) filesystem. The vulnerability is a Use-After-Free (UAF) in worker threads mbm_handle_overflow() and cqm_handle_limbo() . The root cause is that these workers may be blocked waiting for cpus...

CVE-2026-90367

CVE-2026-90367 is a race condition in the Linux kernel's mt76 WiFi driver, specifically affecting the mt7996 hardware. The root cause is that mt7996_mac_reset_work() parked the TX worker and disabled RX/TX NAPIs before taking dev->mt76.mutex, while __mt76_set_channel() toggles the same worker ...

Pocketbase: Unhandled panic in worker goroutines

PocketBase already has builtin panic-recover middleware for the regular requests handling but it doesn't cover panics in internal child/worker goroutines which in some situations could cause termination of the server process. To prevent this from hapenning all existing internal worker functions...

EUVD-2026-80831

Pocketbase: Unhandled panic in worker goroutines...

GHSA-84VH-M24Q-WJJX Pocketbase: Unhandled panic in worker goroutines

PocketBase already has builtin panic-recover middleware for the regular requests handling but it doesn't cover panics in internal child/worker goroutines which in some situations could cause termination of the server process. To prevent this from hapenning all existing internal worker functions...

unbound: Unbound: Denial of Service via continuous queries on TCP/DoT connection

A flaw was found in Unbound. A malicious actor can exploit a vulnerability in the TCP/DoT reading procedure, which lacks a limit on consecutive reads. By continuously streaming distinct uncached names over a TCP/DoT connection, an attacker can monopolize a worker's event loop. This can lead to a...

CVE-2026-93436: Missing Release of Memory after Effective Lifetime

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with maxtokens=0 to exhaust decode-worker memory without bound until the worker restarts...