Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105733 | high | 8.8 | No | Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally. | 2026-10-28 |
| CVE-2026-98117 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix potential UAF/KASAN warning Currently, trace_cachefile... | 2026-10-28 |
| CVE-2026-98118 | high | 7.1 | No | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix readahead synchronisation issues by loading all folios upfro... | 2026-10-28 |
| CVE-2026-116172 | high | 7.5 | No | vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers t... | 2026-10-28 |
| CVE-2026-116173 | high | 7.5 | No | vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing... | 2026-10-28 |
| CVE-2026-116175 | medium | 6.5 | No | vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without... | 2026-10-28 |
| CVE-2026-116176 | high | 8.2 | No | vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by... | 2026-10-28 |
| CVE-2026-116178 | high | 7.5 | No | vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending incons... | 2026-10-28 |
| CVE-2026-116179 | high | 7.5 | No | vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap... | 2026-10-28 |
| CVE-2026-116180 | high | 7.7 | No | vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int... | 2026-10-28 |
| CVE-2026-116187 | medium | 5.0 | No | Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants... | 2026-10-28 |
| CVE-2026-116188 | medium | 5.3 | No | rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses... | 2026-10-28 |
| CVE-2026-84496 | medium | 6.5 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2.... | 2026-10-28 |
| CVE-2026-115912 | high | 8.8 | No | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory a... | 2026-10-28 |
| CVE-2026-115913 | medium | 6.5 | No | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py an... | 2026-10-28 |
| CVE-2026-115915 | critical | 9.8 | No | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to P... | 2026-10-28 |
| CVE-2026-115916 | medium | 6.5 | No | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-... | 2026-10-28 |
| CVE-2026-65327 | high | 8.4 | No | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A... | 2026-10-28 |
| CVE-2026-116891 | medium | 6.1 | No | SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to i... | 2026-10-28 |
| CVE-2026-116889 | medium | 6.1 | No | SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to in... | 2026-10-28 |