CVE-2026-93091: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Quiesce notifications before teardown scminotificationexit clears and releases the notification instance, but transport callbacks can still deliver incoming notifications until the TX/RX channels are freed...

Angie -- worker process memory corruption when using HTTP/3

The Angie Software Team reports: When using an OpenSSL version without native HTTP/3 support 3.5.0 or earlier, if the default server for the address that accepted a regular HTTPS request also used HTTP/3 the listen directive with the quic parameter, possibly on a different port, while a server...

PT-2026-94857

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the recover worker function within the drm/msm component. The get pid task function increments the task reference count, but the corresponding put task struct...

PT-2026-102782

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max tokens=0 to exhaust decode-worker memory without bound until the worker restarts...

CVE-2026-93099: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix UAF from worker threads when domains are removed The mbmhandleoverflow and cqmhandlelimbo workers read event counters and may sleep while doing so. They are scheduled via delayedwork embedded in struct...

CVE-2026-54649: Exposure of Sensitive Information to an Unauthorized Actor

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...

PT-2026-94958

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the QAT reset worker where SR-IOV re-enable work is queued using a work struct and completion embedded in an on-stack adf sriov dev data. If the completion wait times...

CVE-2026-54339: Server-Side Request Forgery (SSRF)

Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feedurl to discoverfeedfeedurl, creates a subscription through FeedService.createsubscription, and enqueues fetchfeedtask. The background path calls...

PT-2026-94159

Name of the Vulnerable Software and Affected Versions NeuVector versions prior to 5.4.11 NeuVector versions prior to 5.5.4 NeuVector versions prior to 5.6.2 Description Improper parameter handling in the packet capture mechanism allows an authenticated user with namespaced Runtime Policies write...

PT-2026-94887

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory management issue exists in the arm scmi firmware component. The scmi notification exit function releases the notification instance while transport callbacks may still deliver...

CVE-2026-69147

A flaw was found in vLLM, an inference and serving engine for large language models. An attacker can exploit this by submitting specially crafted video requests that force the use of the PyNvVideoCodec GPU decoder. This bypasses the engine's static GPU memory reservation, allowing the attacker to...

CVE-2026-57173

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the inputaudio handling path for /v1/chat/completions calls AudioMediaIO.loadbytes or AudioMediaIO.loadfile without passing VLLMMAXAUDIODECODEDURATIONS to the shared audio decoder. An unauthenticated client can...

SUSE CVE-2026-78424

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector's internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

CVE-2026-82410 Pocketbase: Unhandled panic in worker goroutines

Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server proces...

CVE-2026-82410 Pocketbase: Unhandled panic in worker goroutines

Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server proces...

CVE-2026-82410

Pocketbase , an open-source web backend written in Go, is vulnerable to a denial of service due to its panic-recovery middleware failing to cover internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server process . The fix, intro...

CVE-2026-82410 Pocketbase: Unhandled panic in worker goroutines

Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server proces...

CVE-2026-92615

A flaw was found in flightctl. The configureRepoHTTPSClient function in the device-render worker builds a per-repository tls.Config which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates and installs it into go-git's process-global client.Protocols m...

DEBIAN-CVE-2026-89860

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Initialize NVMe abortwork once at submission qlanvmefcpabort and qlanvmelsabort ran INITWORK on priv-abortwork immediately before schedulework. INITWORK reinitializes the workstruct, resetting its list head and...

CVE-2026-89875

This is a use-after-free vulnerability in the Linux kernel's Texas Instruments VIP (Video Imaging Processors) driver, specifically the vpe media subsystem. The root cause is that vip_stop_streaming() masks and clears per-list IRQs but does not synchronize the hardirq handler or disable the recove...