vLLM versions from 0.11.1 up to but not including 0.32.0 contain a reachable assertion vulnerability (CWE-617) in the image processing path for certain OCR models. A remote client with access to the OpenAI-compatible API can submit a specific image that causes a fatal assertion failure, resulting in a shutdown of the inference engine for all users. This denial-of-service condition is fixed in version 0.32.0.
CVE-2026-72758 is a vulnerability in NLnet Labs' Routinator where improper handling of AS range parsing can cause the software to run out of memory. This occurs when the maximum value of an AS range is smaller than the minimum value, leading to an infinite loop during parsing.
CVE-2026-72757 is a vulnerability in NLnet Labs Routinator where the HTTP server runs out of open connections if many connections are opened but never closed. This leads to the HTTP server becoming unavailable. The issue can be exploited by an attacker opening a large number of connections to the server. It affects users who expose their HTTP or RTR server to untrusted networks.
CVE-2026-72756 is a vulnerability in NLnet Labs' Routinator where the software exits unexpectedly when processing an rsync URI for a file obtained over RRDP if the file path is invalid for storage on disk. This includes cases such as excessively long file names or folder names that conflict with existing file names.
CVE-2026-72755 is a vulnerability in NLnet Labs' Routinator where the software improperly handles exceptional conditions by caching a newly retrieved Trust Anchor (TA) certificate over HTTPS without validating it. This can lead to overwriting a known good TA certificate even if the validation of the new certificate fails.
CVE-2026-72754 is a vulnerability in NLnet Labs Routinator where improper handling of exceptional conditions can cause the software to hang or run out of memory when processing a CRL with many entries, or to exit unexpectedly if the CRL file has the wrong encoding.
CVE-2026-72753 is a vulnerability in NLnet Labs' Routinator where the software improperly handles exceptional conditions in RRDP notification files. Specifically, Routinator accepts and parses notification files with gaps in delta entries, which can lead to missing data. Additionally, processing too many delta entries may cause the application to run out of memory. This vulnerability has a high severity rating with a CVSS score of 8.2.
CVE-2026-72752 affects NLnet Labs' Routinator, causing it to run out of memory when JSON output is requested many times concurrently. An attacker can exploit this by opening numerous connections to the HTTP server. Additionally, Routinator may experience a stack overflow and crash when discarding a payload item with excessive metadata. This vulnerability impacts users exposing their HTTP or RTR server to untrusted networks.
CVE-2026-116384 is an improper authorization vulnerability in Bdtask Garage 24 Garage Management Software version 1.0. The flaw exists in the backend component and can be exploited remotely without user interaction. Public exploit code is available, but the vendor has not responded or issued a fix. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.
vLLM versions prior to 0.32.0 contain a resource allocation vulnerability in the Phi-4 multimodal audio encoder. The default use of eager attention causes large attention matrices to be fully materialized in GPU memory when processing long audio clips, leading to quadratic memory consumption. This can result in out-of-memory conditions that terminate the EngineCore process, affecting all users. The issue is resolved in version 0.32.0.
CVE-2026-115912 is a deserialization vulnerability in vllm versions prior to 0.32.0. An authenticated user can supply crafted shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, this leads to arbitrary Python code execution via pickle.loads(). The issue is fixed in version 0.32.0.
CVE-2026-115418 is a SQL injection vulnerability in the AWS Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module. This module provides experimental constructs for managing Amazon Redshift users, tables, and privileges. The vulnerability allows crafted user names, comments, or passwords to alter SQL commands executed with Amazon Redshift superuser privileges during deployment, potentially granting access to all cluster users. Exploitation requires the ability to influence the CDK application's construct property values. Versions prior to 2.274.0-alpha.0 are affected.
A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.
CVE-2026-115911 is a vulnerability in vllm, an inference and serving engine for large language models, affecting versions from 0.19.0 up to but not including 0.32.0. Authenticated users can supply a chat template that is compiled and rendered without limits on execution time, output size, or iterations. This can cause a nonterminating render that blocks server responses or an output-expanding render that exhausts server memory. Harmony models are not affected. The issue is fixed in version 0.32.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through 1.2.0.
CVE-2026-115910 is a vulnerability in python-social-auth's social-core component prior to version 6.2.0. It involves insufficient verification of the OpenID Connect nonce, which is stored globally rather than being bound to the initiating browser session and OAuth state. This flaw allows an attacker who obtains a victim's unused authorization code to reuse it with a valid state from a separate login, bypassing nonce validation and potentially logging in as the victim if PKCE is disabled. The issue is fixed in version 6.2.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.