Aiohttp Memory Initialization Error DoS

The vulnerability of the Aiohttp HTTP client is related to memory initialization errors. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Aiohttp HTTP Client Resource Leak DoS

The vulnerability of the Aiohttp HTTP client is related to errors during resource release. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Aiohttp HTTP Client DoS

The vulnerability of the Aiohttp HTTP client is related to the allocation of unlimited memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

HTTP/3 Server Data Compromise

The vulnerability of HTTP/3 server-side software such as HAProxy is related to errors in processing input data length parameters. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected information...

CVE-2026-107807: Cleartext Storage of Sensitive Information

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...

Golang net/http DoS

The vulnerability of the net/http component in the Golang programming language is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Linux Distros Unpatched Vulnerability : CVE-2026-97032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder...

Linux Distros Unpatched Vulnerability : CVE-2026-107399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS8.5:CLSA-2026:1791552137)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791552137 advisory. - A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untruste...

Linux Distros Unpatched Vulnerability : CVE-2026-107715

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host...

Cisco NX-OS Software NX-API RCE (cisco-sa-napi-rce-r2shwu2j)

According to its self-reported version, Cisco UCS Manager Software is affected by a vulnerability. - A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS...

Progress Telerik Fiddler Classic < 6.0.20262.10021 Multiple Vulnerabilities

The version of Progress Telerik Fiddler Classic installed on the remote Windows host is prior to 6.0.20262.10021. It is, therefore, affected by multiple vulnerabilities: - An insufficient integrity check on external helper tools allows a local low-privileged attacker to replace a helper executabl...

Linux Distros Unpatched Vulnerability : CVE-2026-78669

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS...

CVE-2026-107938: Improper Validation of Certificate with Host Mismatch

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

openSUSE 16 Security Update : amazon-ecs-init (openSUSE-SU-2026:22035-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22035-1 advisory. - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs...

Aiohttp HTTP Client DoS

The vulnerability of the Aiohttp HTTP client is related to the allocation of unlimited memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

CVE-2026-78663

A flaw was found in Go's HTTP/2 server implementation. A remote attacker can bypass connection-level flow control limits—mechanisms that regulate incoming network data—potentially causing excessive memory consumption and a Denial of Service DoS. This issue occurs because the server improperly...

CVE-2026-56866

A flaw was found in Go's net/http package. When an HTTP CONNECT request with a request body is rejected by a server, the client transport can desynchronize the connection before returning it to the shared idle pool. In shared reverse proxy environments, a remote attacker can exploit this issue to...

CVE-2026-97032

A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service DoS by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK HTTP/2 header compression encoder when encoding response headers while processing incoming table...

CVE-2026-94439

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...