Permalink CVE-2026-89267

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 3 hours ago

starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

• Unenforced searchable_fields allowlist in _validate_where() at 0.17.1 technical-description
• https://github.com/jowilf/starlette-admin product
• VulnCheck Advisory: starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass third-party-advisory

---

starlette-admin

• =<0.17.1

Needs a backport to stable

Permalink CVE-2026-90558

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 3 hours ago

sngrep through 1.8.4 Stack Buffer Overflow via SIP Headers

• Patch Commit patch
• https://github.com/irontec/sngrep product
• https://github.com/irontec/sngrep/blob/v1.8.4/src/sip_call.c#L260 technical-description
• https://github.com/irontec/sngrep/blob/v1.8.4/src/sip_msg.c#L150 technical-description
• VulnCheck Advisory: sngrep through 1.8.4 Stack Buffer Overflow via SIP Headers third-party-advisory

---

sngrep

• =<1.8.4

Needs a backport

Permalink CVE-2026-90467

6.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 3 hours ago

aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

• Patch Commit patch
• aiosmtplib v5.1.3 Release Notes release-notes
• Unvalidated quote_address() in v5.1.2 technical-description
• https://github.com/cole/aiosmtplib product
• VulnCheck Advisory: aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses third-party-advisory

---

aiosmtplib

• <5.1.3
• ==5.1.3

Permalink CVE-2026-73558

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 4 weeks, 2 days ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

vLLM: Cross-User Data Leak Vulnerability

• https://github.com/vllm-project/vllm/security/advisories/GHSA-7m6h-x95x-82q5 x_refsource_CONFIRMexploit
• https://github.com/vllm-project/vllm/issues/42860 x_refsource_MISC
• https://github.com/vllm-project/vllm/pull/49660 x_refsource_MISC
• https://github.com/vllm-project/vllm/commit/451227cb3ff07989698fed982c2d3e4300257924 x_refsource_MISC
• https://github.com/vllm-project/vllm/releases/tag/v0.27.0 x_refsource_MISC

---

vllm

• ==< 0.27.0

Permalink CVE-2026-73559

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 4 weeks, 2 days ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

vLLM: Completion prompt lists fan out into unbounded engine requests

• https://github.com/vllm-project/vllm/security/advisories/GHSA-87x5-vmc3-756j x_refsource_CONFIRM
• https://github.com/vllm-project/vllm/pull/47845 x_refsource_MISC
• https://github.com/vllm-project/vllm/commit/675f4295cdfe0d870471c2b51bfeca3a68a9569e x_refsource_MISC
• https://github.com/vllm-project/vllm/releases/tag/v0.26.0 x_refsource_MISC

---

vllm

• ==>= 0.19.0, < 0.26.0

Permalink CVE-2026-73556

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 4 weeks, 2 days ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574

• https://github.com/vllm-project/vllm/security/advisories/GHSA-48jh-3gj7-fg8v x_refsource_CONFIRM
• https://github.com/vllm-project/vllm/pull/47595 x_refsource_MISC
• https://github.com/vllm-project/vllm/commit/c9a788eedc412acceaa5112e0d44624b49841577 x_refsource_MISC
• https://github.com/vllm-project/vllm/releases/tag/v0.26.0 x_refsource_MISC

---

vllm

• ==< 0.26.0

Permalink CVE-2026-73557

6.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 4 weeks, 2 days ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

• https://github.com/vllm-project/vllm/security/advisories/GHSA-pr7f-p5mw-fc87 x_refsource_CONFIRM
• https://github.com/vllm-project/vllm/pull/48583 x_refsource_MISC
• https://github.com/vllm-project/vllm/commit/793cf79c89d4049124e756915468ac30318f2e50 x_refsource_MISC
• https://github.com/vllm-project/vllm/releases/tag/v0.26.0 x_refsource_MISC

---

vllm

• ==>= 0.20.2rc0, < 0.26.0

Permalink CVE-2026-71486

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 5 days ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

• https://github.com/vllm-project/vllm/security/advisories/GHSA-8737-qx52-hjff x_refsource_CONFIRM
• https://github.com/vllm-project/vllm/pull/47260 x_refsource_MISC
• https://github.com/vllm-project/vllm/commit/8e61b646e2d157f9b93451fa048f9c8530c8a67b x_refsource_MISC
• https://github.com/vllm-project/vllm/releases/tag/v0.26.0 x_refsource_MISC

---

vllm

• ==< 0.26.0

Permalink CVE-2026-78684

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 2 weeks, 4 days ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

vLLM before 0.27.0 Denial of Service via DeepStream Backend

• GitHub Security Advisory (GHSA-cqm8-jxg6-fqfq) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: vLLM before 0.27.0 Denial of Service via DeepStream Backend third-party-advisory

---

vllm

• ==0.27.0
• <0.27.0

Permalink CVE-2026-90553

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor

• GitHub Security Advisory (GHSA-3c86-2m5g-59q7) vendor-advisory
• VulnCheck Advisory: vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor third-party-advisory

---

vLLM

• <0.28.0
• ==0.28.0

Permalink CVE-2026-90554

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

vLLM before 0.28.0 Denial of Service via audio extraction

• GitHub Security Advisory (GHSA-936p-m5pv-vvjf) vendor-advisory
• VulnCheck Advisory: vLLM before 0.28.0 Denial of Service via audio extraction third-party-advisory

---

vLLM

• <0.28.0
• ==0.28.0

Permalink CVE-2026-90555

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 5 hours ago

vLLM before 0.28.0 Denial of Service via Audio Header

• GitHub Security Advisory (GHSA-99f2-hwrc-gvq8) vendor-advisory
• VulnCheck Advisory: vLLM before 0.28.0 Denial of Service via Audio Header third-party-advisory

---

vLLM

• <0.28.0
• ==0.28.0

Permalink CVE-2026-73555

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 4 weeks, 2 days ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

• https://github.com/vllm-project/vllm/security/advisories/GHSA-hwrm-c4cx-rf4j x_refsource_CONFIRM
• https://github.com/vllm-project/vllm/pull/46415 x_refsource_MISC
• https://github.com/vllm-project/vllm/commit/e87521626febe2763f997691d1599de4175f4324 x_refsource_MISC
• https://github.com/vllm-project/vllm/releases/tag/v0.26.0 x_refsource_MISC

---

vllm

• ==< 0.26.0

Permalink CVE-2026-73560

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 5 days ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

• https://github.com/vllm-project/vllm/security/advisories/GHSA-4hhp-h66f-j5j7 x_refsource_CONFIRM
• https://github.com/vllm-project/vllm/pull/43117 x_refsource_MISC
• https://github.com/vllm-project/vllm/commit/54503ecec0f3ac31e5ecfc5f28652e4cc42307b5 x_refsource_MISC
• https://github.com/vllm-project/vllm/releases/tag/v0.26.0 x_refsource_MISC

---

vllm

• ==< 0.26.0

Permalink CVE-2026-90557

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via Savegame

• Patch Commit patch
• https://github.com/freeciv/freeciv product
• https://redmine.freeciv.org/issues/2162 issue-tracking
• https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame3.c#L6108 technical-description
• freeciv R3_2_6 Release Notes release-notes
• https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame2.c#L4282 technical-description
• VulnCheck Advisory: Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via Savegame third-party-advisory

---

freeciv

• <3.2.6

Permalink CVE-2026-90556

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load

• Patch Commit patch
• https://github.com/freeciv/freeciv product
• https://redmine.freeciv.org/issues/2161 issue-tracking
• https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame3.c#L964 technical-description
• freeciv R3_2_6 Release Notes release-notes
• https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame2.c#L788 technical-description
• VulnCheck Advisory: Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load third-party-advisory

---

freeciv

• <3.2.6

Permalink CVE-2026-89012

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 13 hours ago
• @LeSuisse accepted 1 day, 7 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter

• Release Notes release-notes
• Patch Commit patch
• https://www.vulncheck.com/advisories/dolibarr-sql-filter-denylist-bypass-via-sq… third-party-advisory

---

Dolibarr

• <24.0.1

Permalink CVE-2026-89013

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 13 hours ago
• @LeSuisse accepted 1 day, 7 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php

• Release Notes release-notes
• Patch Commit patch
• https://www.vulncheck.com/advisories/dolibarr-authorization-bypass-via-hashp-pa… third-party-advisory

---

Dolibarr

• <24.0.1

Permalink CVE-2026-88045

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  9 packages

  • librclone
  • rclone-ui
  • syncrclone
  • rclone-browser
  • plakar-plugin-rclone
  • git-annex-remote-rclone
  • gnomeExtensions.rclone-manager
  • python313Packages.rclone-python
  • python314Packages.rclone-python
  2 days, 1 hour ago
• @LeSuisse ignored maintainer @SuperSandro2000 2 days, 1 hour ago maintainer.ignore
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rclone: S3 multipart declared-length memory exhaustion

• https://github.com/rclone/rclone/security/advisories/GHSA-2p48-j3qc-rx9f exploitx_refsource_CONFIRM
• https://github.com/rclone/rclone/issues/9616 x_refsource_MISC
• https://github.com/rclone/rclone/commit/7c1dfd99f3e6a22fcefd8686cc478226a15e63a1 x_refsource_MISC
• https://github.com/rclone/rclone/commit/ab1f458013aaf6356e4bdeca61f7cb9139f8eb86 x_refsource_MISC
• https://github.com/rclone/rclone/releases/tag/v1.75.1 x_refsource_MISC

---

rclone

• ==>= 1.75.0, < 1.75.1

Permalink CVE-2026-88044

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  9 packages

  • librclone
  • rclone-ui
  • syncrclone
  • rclone-browser
  • plakar-plugin-rclone
  • git-annex-remote-rclone
  • gnomeExtensions.rclone-manager
  • python313Packages.rclone-python
  • python314Packages.rclone-python
  2 days, 1 hour ago
• @LeSuisse ignored maintainer @SuperSandro2000 2 days, 1 hour ago maintainer.ignore
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rclone: RC per-server auth-proxy bypass

• https://github.com/rclone/rclone/security/advisories/GHSA-p569-5gjg-9cmj exploitx_refsource_CONFIRM
• https://github.com/rclone/rclone/commit/739403963abf6f58003c2becd5f7c4ad0d644153 x_refsource_MISC
• https://github.com/rclone/rclone/releases/tag/v1.75.1 x_refsource_MISC

---

rclone

• ==>= 1.70.0, < 1.75.1

Permalink CVE-2026-88018

9.8 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  9 packages

  • librclone
  • rclone-ui
  • syncrclone
  • rclone-browser
  • plakar-plugin-rclone
  • git-annex-remote-rclone
  • gnomeExtensions.rclone-manager
  • python313Packages.rclone-python
  • python314Packages.rclone-python
  2 days, 1 hour ago
• @LeSuisse ignored maintainer @SuperSandro2000 2 days, 1 hour ago maintainer.ignore
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

• https://github.com/rclone/rclone/security/advisories/GHSA-xwwr-4h3p-r22c exploitx_refsource_CONFIRM
• https://github.com/rclone/rclone/commit/90595f34f27f569be6b27c57fe5ab65057d323bd x_refsource_MISC
• https://github.com/rclone/rclone/releases/tag/v1.75.1 x_refsource_MISC

---

rclone

• ==< 1.75.1

Permalink CVE-2026-88017

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  9 packages

  • librclone
  • rclone-ui
  • syncrclone
  • rclone-browser
  • plakar-plugin-rclone
  • git-annex-remote-rclone
  • gnomeExtensions.rclone-manager
  • python313Packages.rclone-python
  • python314Packages.rclone-python
  2 days, 1 hour ago
• @LeSuisse ignored maintainer @SuperSandro2000 2 days, 1 hour ago maintainer.ignore
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rclone: FTP cross-session auth-proxy backend confusion

• https://github.com/rclone/rclone/security/advisories/GHSA-c476-6w5q-jw77 x_refsource_CONFIRM
• https://github.com/rclone/rclone/commit/c6af0b57c2b4af848bc968c2b407354476184b99 x_refsource_MISC
• https://github.com/rclone/rclone/releases/tag/v1.75.1 x_refsource_MISC

---

rclone

• ==>= 1.64.0, < 1.75.1

Permalink CVE-2026-88015

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  9 packages

  • librclone
  • rclone-ui
  • syncrclone
  • rclone-browser
  • plakar-plugin-rclone
  • git-annex-remote-rclone
  • gnomeExtensions.rclone-manager
  • python313Packages.rclone-python
  • python314Packages.rclone-python
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored maintainer @SuperSandro2000 2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rclone local: crafted Range request against a translated symlink panics (DoS)

• https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw exploitx_refsource_CONFIRM
• https://github.com/rclone/rclone/commit/28bf49d66f94acc3f4f7f318504a706686281af9 x_refsource_MISC
• https://github.com/rclone/rclone/releases/tag/v1.75.1 x_refsource_MISC

---

rclone

• ==< 1.75.1

Permalink CVE-2026-88013

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  9 packages

  • librclone
  • rclone-ui
  • syncrclone
  • rclone-browser
  • plakar-plugin-rclone
  • git-annex-remote-rclone
  • gnomeExtensions.rclone-manager
  • python313Packages.rclone-python
  • python314Packages.rclone-python
  2 days, 1 hour ago
• @LeSuisse ignored maintainer @SuperSandro2000 2 days, 1 hour ago maintainer.ignore
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rclone: http backend forwards custom/auth headers to a different host on redirect

• https://github.com/rclone/rclone/security/advisories/GHSA-486v-q2wf-fp2r exploitx_refsource_CONFIRM
• https://github.com/rclone/rclone/commit/22859b7e696cea3c563c6ba04c6b7f91f74456b4 x_refsource_MISC
• https://github.com/rclone/rclone/commit/79fbc0842f74e02cb84f0e3e7261d169983c8831 x_refsource_MISC
• https://github.com/rclone/rclone/commit/925fb4fb21eb25e75cd1b64fdd17ded857784bfc x_refsource_MISC
• https://github.com/rclone/rclone/releases/tag/v1.75.1 x_refsource_MISC

---

rclone

• ==>= 1.49.0, < 1.75.1

Permalink CVE-2026-88046

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  9 packages

  • librclone
  • rclone-ui
  • syncrclone
  • rclone-browser
  • plakar-plugin-rclone
  • git-annex-remote-rclone
  • gnomeExtensions.rclone-manager
  • python313Packages.rclone-python
  • python314Packages.rclone-python
  2 days, 1 hour ago
• @LeSuisse ignored maintainer @SuperSandro2000 2 days, 1 hour ago maintainer.ignore
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rclone: source object names can escape the configured root on upload

• https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq x_refsource_CONFIRM
• https://github.com/rclone/rclone/commit/57842c5ee4e1407eda06a414a36510cce2db4252 x_refsource_MISC
• https://github.com/rclone/rclone/releases/tag/v1.75.1 x_refsource_MISC

---

rclone

• ==< 1.75.1

Permalink CVE-2026-88016

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  9 packages

  • librclone
  • rclone-ui
  • syncrclone
  • rclone-browser
  • plakar-plugin-rclone
  • git-annex-remote-rclone
  • gnomeExtensions.rclone-manager
  • python313Packages.rclone-python
  • python314Packages.rclone-python
  2 days, 1 hour ago
• @LeSuisse ignored maintainer @SuperSandro2000 2 days, 1 hour ago maintainer.ignore
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

• https://github.com/rclone/rclone/security/advisories/GHSA-f8g7-2xjc-7mfh x_refsource_CONFIRM
• https://github.com/rclone/rclone/commit/17b0c03338a857bcb0a68d2d4c82ddbdec3f7893 x_refsource_MISC
• https://github.com/rclone/rclone/commit/a7ab39d3d1958afa1446982c1dc4e4a73a887e3e x_refsource_MISC
• https://github.com/rclone/rclone/releases/tag/v1.75.1 x_refsource_MISC

---

rclone

• ==< 1.75.1

Permalink CVE-2026-88014

6.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  9 packages

  • librclone
  • rclone-ui
  • syncrclone
  • rclone-browser
  • plakar-plugin-rclone
  • git-annex-remote-rclone
  • gnomeExtensions.rclone-manager
  • python313Packages.rclone-python
  • python314Packages.rclone-python
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored maintainer @SuperSandro2000 2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

• https://github.com/rclone/rclone/security/advisories/GHSA-66hp-wgxq-6f5q exploitx_refsource_CONFIRM
• https://github.com/rclone/rclone/commit/5dae3adbf571a6cd9ba501eb47397a7e871e1ae0 x_refsource_MISC
• https://github.com/rclone/rclone/commit/6507e13d5a83789f500af96d7188c302c9d74d98 x_refsource_MISC
• https://github.com/rclone/rclone/releases/tag/v1.75.1 x_refsource_MISC

---

rclone

• ==>= 1.72.0, < 1.75.1

Permalink CVE-2026-89087

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 2 days, 9 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  21 packages

  • python313Packages.cstruct
  • python314Packages.cstruct
  • ocamlPackages.cstruct-lwt
  • ocamlPackages.ppx_cstruct
  • ocamlPackages.cstruct-sexp
  • ocamlPackages.cstruct-unix
  • ocamlPackages.eqaf-cstruct
  • ocamlPackages.cstruct-async
  • ocamlPackages.ipaddr-cstruct
  • ocamlPackages_latest.cstruct
  • ocamlPackages.macaddr-cstruct
  • ocamlPackages_latest.cstruct-lwt
  • ocamlPackages_latest.ppx_cstruct
  • ocamlPackages_latest.cstruct-sexp
  • ocamlPackages_latest.cstruct-unix
  • ocamlPackages_latest.eqaf-cstruct
  • python313Packages.dissect-cstruct
  • python314Packages.dissect-cstruct
  • ocamlPackages_latest.cstruct-async
  • ocamlPackages_latest.ipaddr-cstruct
  • ocamlPackages_latest.macaddr-cstruct
  2 days, 9 hours ago
• @LeSuisse restored package ocamlPackages_latest.cstruct 2 days, 9 hours ago
• @LeSuisse accepted 2 days, 9 hours ago
• @LeSuisse published on GitHub 2 days, 9 hours ago

The cstruct package before 6.3.0 for OCaml mishandles indexes.

• https://osv.dev/vulnerability/OSEC-2026-20

---

cstruct

• <6.3.0

Permalink CVE-2026-89086

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 2 days, 9 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  14 packages

  • cjose
  • jose
  • haskellPackages.jose
  • haskellPackages.jose-jwt
  • python313Packages.djoser
  • python313Packages.josepy
  • python314Packages.djoser
  • python314Packages.josepy
  • ocamlPackages_latest.jose
  • python313Packages.joserfc
  • python314Packages.joserfc
  • python313Packages.python-jose
  • python314Packages.python-jose
  • home-assistant-custom-components.calendar_export
  2 days, 9 hours ago
• @LeSuisse restored package ocamlPackages_latest.jose 2 days, 9 hours ago
• @LeSuisse accepted 2 days, 9 hours ago
• @LeSuisse published on GitHub 2 days, 9 hours ago

In the jose package before 0.11.0 for OCaml, library calls …

• https://github.com/ulrikstrid/ocaml-jose/commit/cf17d991ec6a0d1997956b6c7799890…
• https://osv.dev/vulnerability/OSEC-2026-19

---

jose

• <0.11.0

Permalink CVE-2026-88924

7.0 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 days, 9 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  2 packages

  • gnome.gvfs
  • yaziPlugins.gvfs
  2 days, 9 hours ago
• @LeSuisse accepted 2 days, 9 hours ago
• @LeSuisse published on GitHub 2 days, 9 hours ago

Gvfs: gvfs-admin socket ownership race permits local root

• https://access.redhat.com/security/cve/CVE-2026-88924 vdb-entryx_refsource_REDHAT
• RHBZ#2531456 issue-trackingx_refsource_REDHAT
• https://gitlab.gnome.org/GNOME/gvfs/-/issues/875 exploit

---

gvfs

Patch: https://gitlab.gnome.org/GNOME/gvfs/-/commit/371909dd201eb66c5c4d18d9e88fdae4a070b76a