Loading story…
dCERT published two security advisories covering separate software risks: multiple vulnerabilities in vllm and a VMware Tanzu Spring Security flaw that can bypass security measures. The vllm advisory identifies more than one issue affecting the large language model serving software, while the Spring Security advisory warns that affected deployments may allow protections to be circumvented.
The notices indicate that organizations using either product should review the relevant dCERT advisories, determine exposure in their environments, and prioritize remediation. The Spring Security issue is especially significant for internet-facing or authentication-dependent applications because a bypass in security controls can undermine access restrictions, while the vllm findings raise concern for AI infrastructure operators running vulnerable versions in production or shared environments.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
dCERT published Advisory 2026-1341 for vLLM describing a vulnerability that allows denial of service. The reference does not provide additional technical details, exploitation information, or remediation timeline.
dCERT published Advisory 2026-1279 for vLLM describing a vulnerability that allows denial of service. The reference does not provide additional technical details, exploitation information, or remediation timeline.
dCERT published Advisory 2026-1267 for vLLM, describing a KV Block Handler vulnerability that allows manipulation of files. The reference does not provide additional technical details, exploitation information, or remediation timeline.
dCERT published Advisory 2026-1199 for VMware Tanzu Spring Security identifying multiple vulnerabilities. The reference does not provide additional technical details, exploitation information, or remediation timeline.
dCERT published Advisory 2026-0966 for vLLM identifying multiple vulnerabilities. The reference provides no additional technical details, exploitation information, or remediation timeline.
dCERT published Advisory 2026-0869 for vLLM describing a vulnerability that allows code execution. The reference does not provide additional technical details or remediation information.
dCERT published Advisory 2026-0783 for VMware Tanzu Spring Security, describing a vulnerability that allows bypassing security measures. The reference does not include further details on exploitation or patch availability.
dCERT published Advisory 2026-0194 for vLLM, identifying multiple vulnerabilities in the software. No additional technical details or remediation timeline are provided in the reference.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
8 references tracked. Mallory keeps watching after this page renders.
dcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spring published advisories for four vulnerabilities affecting its ecosystem, including three flaws in auto-configuration for **Elasticsearch**, **Cassandra**, and **RabbitMQ** that can disable TLS hostname verification when an SSL bundle is used. The issues are tracked as `CVE-2026-40970`, `CVE-2026-40974`, and `CVE-2026-40971`, respectively, and could weaken certificate validation for connections to those backend services. A fourth advisory, `CVE-2026-40972`, affects **Spring DevTools** and states that remote secret comparison is vulnerable to timing attacks. Together, the disclosures highlight risks in both transport security and authentication-related logic, with the TLS-related bugs potentially exposing applications to man-in-the-middle scenarios and the DevTools issue creating an avenue for attackers to infer secrets through response timing differences.
Jun 29, 2026
Critical vulnerabilities were disclosed in **Ivanti Cloud Services Application (CSA)** and **VMware vCenter Server** products, exposing enterprise management platforms to remote compromise. Ivanti said CSA `5.0.2` and earlier contain three flaws—`CVE-2024-11639`, `CVE-2024-11772`, and `CVE-2024-11773`—that can enable authentication bypass, remote code execution, and arbitrary SQL query execution through the administrator browser console, with the most severe issues rated **CVSS 10.0**. Ivanti released fixes in CSA `5.0.3` and urged customers to update immediately. VMware also disclosed two vulnerabilities affecting **vCenter Server** and **VMware Cloud Foundation**: `CVE-2024-38812`, a heap overflow that can allow arbitrary code execution, and `CVE-2024-38813`, which can enable privilege escalation to root. The flaws affect vCenter Server `7.0` and `8.0` as well as VMware Cloud Foundation `4.x` and `5.x`, and can be exploited remotely over the network using specially crafted packets. In both vendor notices, no active exploitation had been confirmed at the time of disclosure, but organizations and service providers were advised to apply vendor-fixed versions without delay because successful attacks could result in full administrative compromise.
Jun 29, 2026
The Canadian Centre for Cyber Security issued advisory **AV26-288** warning that multiple vulnerabilities disclosed by Spring affect **Spring Cloud Config** and **Spring AI**, including **server-side request forgery (SSRF)**, unintended file access, query injection, and a **SpEL injection** that can lead to **remote code execution (RCE)**. The notice says the issues were disclosed by Spring between March 23 and 26 and urged organizations to review the vendor advisories and assess exposure in affected deployments. Affected versions include **Spring Cloud Config** releases prior to **3.1.3**, **4.1.9**, **4.2.6**, **4.3.2**, and **5.0.2**, along with **Spring AI** versions prior to **1.0.5** and **1.1.4**. The Cyber Centre advised administrators and users to apply the relevant updates to reduce the risk of exploitation against exposed services and vulnerable application environments.
Jun 29, 2026