Security Vulnerabilities
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}.. Mattermost Advisory ID: MMSA-2026-00771
CVSS Score
4.3
EPSS Score
0.004
Published
2026-09-22
CVE-2026-93616
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
Known exploited
CVSS Score
9.8
EPSS Score
0.759
Published
2026-09-22
Privilege escalation due to weak configuration during package extraction process.
CVSS Score
8.8
EPSS Score
0.001
Published
2026-09-22
Privilege escalation due to weak configuration while temporary file handling.
CVSS Score
8.8
EPSS Score
0.001
Published
2026-09-22
Improper authorization leads to Remote Code Execution via SocketIO interface.
CVSS Score
9.8
EPSS Score
0.003
Published
2026-09-22
Exposed dangerous function lead to privilege escalation via gRPC server.
CVSS Score
8.8
EPSS Score
0.001
Published
2026-09-22
Memory corruption while processing a crafted ELF file in the Primary Bootloader.
CVSS Score
6.9
EPSS Score
0.001
Published
2026-09-22
CVE-2026-93952
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Known exploited
CVSS Score
9.5
EPSS Score
0.011
Published
2026-09-22
vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in NixlBaseConnectorWorker._apply_prefix_caching by submitting completion requests with multiple prompts of varying lengths, causing the decode worker to terminate and become unavailable until restarted.
CVSS Score
8.7
EPSS Score
0.006
Published
2026-09-21
vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can supply arbitrary remote host and port values in kv_transfer_params to create unreachable peer sessions that retain ZeroMQ sockets until the context quota is exhausted, causing an uncaught ZMQError that crashes EngineCore and stops all inference.
CVSS Score
8.7
EPSS Score
0.006
Published
2026-09-21