UBUNTU-CVE-2026-107714

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

UBUNTU-CVE-2026-107715

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanizerequestheaders= is reapplied by Mechanize::HTTP::Agentrequestaddheaders even after...

MiracleLinux 8 : httpd:2.4 bug fix and enhancement update (AXBA:2026-2033:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXBA:2026-2033:01 advisory. - An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures 30 days in default configurations, to the backoff time...

CentOS Linux 8 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791914243)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1791914243 advisory. - Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs ...

CVE-2026-106176: Missing Authorization

A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Apache HTTP Server vulnerabilities (USN-8898-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8898-1 advisory. It was discovered that Apache HTTP Server's modrewrite module incorrectly handled...

PT-2026-111801

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 4.4.0 through 4.4.9 FortiSandbox versions 5.0.0 through 5.0.6 FortiSandbox PaaS versions 4.4.x and earlier FortiSandbox PaaS versions 5.0.0 through 5.0.6 Description Improper access control and session management in the w...

PT-2026-111780

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 5.2.0 through 5.2.1 FortiSandbox versions 5.0.0 through 5.0.6 FortiSandbox 4.4 affected versions not specified Description An uncaught exception in the Admin Profile occurs when handling exceptional conditions, which may...

Microsoft ASP.NET: CVE-2026-88092: ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

CentOS Linux 6 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ssl (CENTOS6:CLSA-2026:1791487835)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1791487835 advisory. - Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote...

Apache HTTP Server mod_vhost_alias() Code Execution

The vulnerability of the modvhostalias function in the Apache HTTP Server is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure or execute arbitrary code by sending a specially crafted HTTP...

CVE-2026-101899: Protection Mechanism Failure

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NOPROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NOPROXY while a proxy is...

SUSE SLED15 / SLES15 Security Update : go1.27 (SUSE-SU-2026:4625-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4625-1 advisory. Update to go1.27.2 bsc1272545: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on...

PT-2026-112289

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-112910

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

UBUNTU-CVE-2026-107399

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

PT-2026-111480

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5...

PT-2026-111536

FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http chuncked read that allows malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers can send a partial chunk-size line or footer followed by a clean TLS shutdown, causing zero-byte read...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Axios vulnerabilities (USN-8638-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8638-1 advisory. Ameer Assadi discovered that Axios did not properly handle certain hostnames when applying NOPROXY rules. An attacker...

ReactPHP react/http DoS

The vulnerability of the handleData function in the ReactPHP library’s react/http package, which handles streaming HTTP messages, is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a remote attacker to cause a service failure...