https://vulnerability.circl.lu/sightings/feed 2026-10-02T09:53:17.400725+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/1c6b5a2f-1a5f-4295-909e-ce82920a9f4a/export 2026-10-02T09:53:17.428296+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1c6b5a2f-1a5f-4295-909e-ce82920a9f4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90553", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvqrfvggyl2u", "content": "\ud83d\udccc CVE-2026-90553 - vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter... https://www.cyberhub.blog/cves/CVE-2026-90553", "creation_timestamp": "2026-09-17T23:07:07.434238Z"} 2026-09-17T23:07:07.434238+00:00 https://vulnerability.circl.lu/sighting/306d4a3b-9a3e-4f6c-92f5-48618a66e5a7/export 2026-10-02T09:53:17.431842+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "306d4a3b-9a3e-4f6c-92f5-48618a66e5a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90553", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmgdoup424", "content": "CVE-2026-90553 vLLM (<0.28.0) allows malicious models to execute code despite trust_remote_code \u2014 upgrade to v0.28.0 now (CVSS 8.5). https://cti.securitycyber.uk", "creation_timestamp": "2026-09-16T07:27:14.552388Z"} 2026-09-16T07:27:14.552388+00:00 https://vulnerability.circl.lu/sighting/d2cc6e00-4177-43bc-bde1-c5b4bc983119/export 2026-10-02T09:53:17.432005+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "d2cc6e00-4177-43bc-bde1-c5b4bc983119", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90553", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmfvwrx42i", "content": "vLLM CVE-2026-90553 (RCE) lets a malicious model run code in the vLLM process; patch to vLLM 0.28.0 now or disable remote processors: https://cti.securitycyber.uk", "creation_timestamp": "2026-09-16T07:27:00.072089Z"} 2026-09-16T07:27:00.072089+00:00 https://vulnerability.circl.lu/sighting/547bf1cf-3441-4d9e-a10a-59749260f34d/export 2026-10-02T09:53:17.432116+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "547bf1cf-3441-4d9e-a10a-59749260f34d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90553", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmfcqqud2g", "content": "vLLM CVE-2026-90553 (CVSS 8.5) allows RCE via the LlavaOnevision2 processor when trust_remote_code is ignored \u2014 update to v0.28.0. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-16T07:26:40.286282Z"} 2026-09-16T07:26:40.286282+00:00 https://vulnerability.circl.lu/sighting/cf750f75-149f-4a9f-a344-bc859732a610/export 2026-10-02T09:53:17.432227+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "cf750f75-149f-4a9f-a344-bc859732a610", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90553", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmey7k4i22", "content": "vLLM CVE-2026-90553 (CVSS 8.5) allows RCE via LlavaOnevision2 loader; update to vLLM 0.28.0 now and sandbox model loading. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-16T07:26:28.826977Z"} 2026-09-16T07:26:28.826977+00:00 https://vulnerability.circl.lu/sighting/b54371d7-f391-470a-a2d0-aae7831a8721/export 2026-10-02T09:53:17.432351+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "b54371d7-f391-470a-a2d0-aae7831a8721", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90558", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mvifbq7zes2b", "content": "[Backport release-26.05] sngrep: 1.8.3 -> 1.8.4, fix CVE-2026-90558\n\nhttps://github.com/NixOS/nixpkgs/pull/563160\n\nhttps://tracker.security.nixos.org/issues/NIXPKGS-2026-2567\n\n#security", "creation_timestamp": "2026-09-14T15:08:45.139939Z"} 2026-09-14T15:08:45.139939+00:00 https://vulnerability.circl.lu/sighting/05301ce6-37e5-49a6-a71a-1f562e3f093c/export 2026-10-02T09:53:17.432462+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "05301ce6-37e5-49a6-a71a-1f562e3f093c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90558", "type": "seen", "source": "https://bsky.app/profile/nixpkgs-prs-bot.bsky.social/post/3mvgsrrqe4k2u", "content": "Merged PRs for 2026-09-13\n\nPackages\n#563033 wlr-utils: 1.7.0 -> 1.8.0\n#563024 linux_testing: 7.3-rc2 -> 7.3-rc3\n#563020 vaultwarden: 1.37.2 -> 1.37.3\n#562984 npb: add changelog\n#562972 workflows/periodic-merge: use correct permissions\n#562971 sngrep: fix CVE-2026-90558\n", "creation_timestamp": "2026-09-14T00:05:03.352567Z"} 2026-09-14T00:05:03.352567+00:00 https://vulnerability.circl.lu/sighting/de223d83-bae1-4d09-bb2b-37ae44caeae7/export 2026-10-02T09:53:17.432586+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "de223d83-bae1-4d09-bb2b-37ae44caeae7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90558", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mvgisappuh2h", "content": "sngrep: fix CVE-2026-90558\n\nhttps://github.com/NixOS/nixpkgs/pull/562971\n\nhttps://tracker.security.nixos.org/issues/NIXPKGS-2026-2567\n\n#security", "creation_timestamp": "2026-09-13T21:06:21.114317Z"} 2026-09-13T21:06:21.114317+00:00 https://vulnerability.circl.lu/sighting/8c574f54-2feb-4d3c-aa97-9feb2f3b4fc9/export 2026-10-02T09:53:17.432696+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8c574f54-2feb-4d3c-aa97-9feb2f3b4fc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-90558", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mveh3lmsfm2z", "content": "irontec sngrep <=1.8.4 hit by CRITICAL stack buffer overflow (CVE-2026-90558). Malicious SIP headers can crash or lead to RCE. Avoid untrusted SIP packets, check vendor for fixes. https://radar.offseq.com/threat/cve-2026-90558-stack-based-buffer-overflow-in-irontec-sngrep-f0d23a6d23082198 #OffSeq...", "creation_timestamp": "2026-09-13T01:30:27.841052Z"} 2026-09-13T01:30:27.841052+00:00 https://vulnerability.circl.lu/sighting/399917ec-188f-44c2-a3e4-ccc2f6720ba2/export 2026-10-02T09:53:17.432803+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "399917ec-188f-44c2-a3e4-ccc2f6720ba2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-90558", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117261141603138759", "content": "CVE-2026-90558: CRITICAL stack buffer overflow in irontec sngrep (<=1.8.4). Malicious SIP headers can crash or allow code execution. Patch status pending \u2014 filter untrusted SIP traffic. https://radar.offseq.com/threat/cve-2026-90558-stack-based-buffer-overflow-in-irontec-sngrep-f0d23a6d23082198 #OffSeq #CVE202690558 #vuln #SIPrisk", "creation_timestamp": "2026-09-13T01:30:25.721307Z"} 2026-09-13T01:30:25.721307+00:00