CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-

Security Advisory: HTTP Header Injection via Unvalidated CR and LF in Header Values tinyhttp Assigned CVE ID: CVE-2026-66753 Summary tinyhttp does not reject carriage return or line feed inside HTTP header values, in either direction. On the request side, readnextline ends a header line only on...

Malicious code in @galicia-toolkit-nestjs/paas (npm)

Source: amazon-inspector 5df4f7b59cbe90e6b36ce17f0870cd419345167d9aee683d65a43c65ea5fb213 The package's main entry index.js loads a prebuilt native addon prebuilds/-/metrics.node inside a try/catch on require. The ELF reads CI and cloud credentials from the environment — AWSACCESSKEYID,...

Malicious code in @brick-v2/tour (npm)

Source: amazon-inspector aabec40c085d56f59b4ca696eefe600f450a03284df0d77f562d861fed091bee The package presents itself as an Angular-style module exposing forRoot/createLogger stubs and a version field, but these exports are no-ops. The real behavior is in a bundled prebuilt native addon at...

Malicious code in @brick-v2/table (npm)

Source: amazon-inspector 1fdd2bc5b913543c62603b366fb4e1261407f63541e4b01ff7e0052e522523e0 @brick-v2/table presents a trivial Angular-style logger/table shim forRoot/createLogger/version no-ops while index.js unconditionally side-loads prebuilds/-/metrics.node on require. The native addon reads...

CVE-2026-107807 Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...

CVE-2026-59797

A flaw was found in the modssl module of Apache HTTP Server. The SSLRequire directive does not properly restrict file-related expression functions in .htaccess files. An attacker who can write an .htaccess file in a directory where SSLRequire is permitted could use these functions to read files...

Security Bulletin: Security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. IBM WebSphere Application Server Liberty is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak...

SUSE-SU-2026:24126-1 Security update for python-PyJWT

This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint bsc1283060. - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response bsc1283061. -...

httpd bug fix and enhancement update

An update is available for httpd. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The httpd packages provide the Apache HTTP Server, a powerful, efficient, and...

RLSA-2026:79177 Important: mod_auth_openidc security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsi...

mod_auth_openidc security update

An update is available for modauthopenidc. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modauthopenidc is an OpenID Connect authentication module for Apac...

CVE-2026-107938

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

BIT-THRIFT-2026-86537 Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service

Uncaught exception, Loop with unreachable exit condition 'infinite loop', Integer underflow wrap or wraparound vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-107938 Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

kr.jclab.wsman:abstract-wsman (>=0.0.1-rc2, <=0.0.1-rc4), kr.jclab.wsman:abstract-wsman-netty (>=0.0.2-rc1, <=0.0.4) +3 more potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =4.0.0, =0.0.1-rc2, =0.0.2-rc1, =4.0.2, =4.0.0, =4.0.0, =4.1.8 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

org.apache.cxf.systests:cxf-systests-transport-netty (>=3.5.7, <=3.6.3), org.apache.cxf:apache-cxf (>=3.0.0, <=3.6.12) +1 more potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=3.0.0, <=3.6.12)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =3.0.0, =3.5.7, =3.0.0, =3.0.0, =3.6.12 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

CVE-2026-107938

The Apache CXF Netty-based HTTP client transport (cxf-rt-transports-http-netty-client ) fails to verify that the hostname in a server's TLS certificate matches the host being called. This flaw impacts both HTTP/1.1 and HTTP/2 protocols, even when the disableCNCheck parameter is set to its default...

EUVD-2026-95703

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

org.apache.cxf:apache-cxf (>=4.2.0, <=4.2.3), org.apache.cxf:cxf-distribution-manifest (>=4.2.0, <=4.2.3) potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =4.2.0, =4.2.0, =4.2.0, =4.2.3 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

SUSE-SU-2026:4602-1 Security update for php8

This update for php8 fixes the following issues: - CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser bsc1282981. - CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing bsc1283216. - CVE-2026-6103: Archive entry injection via...