CVE-2026-18516

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...

EUVD-2026-102873

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...

CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...

CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...

CVE-2026-18516

The Audit Logs component of Crafty Controller is vulnerable to an output escaping flaw (CWE-116 ). A remote, unauthenticated attacker can perform stored cross-site scripting (XSS) by leveraging HTTP header injection . No specific remediation or exploit details are provided in the documents.

Security update for libsoup2

This update for libsoup2 fixes the following issues: CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol...

SUSE-SU-2026:4703-1 Security update for libsoup2

This update for libsoup2 fixes the following issues: - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch bsc1272195. - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol...

flipper-mcp

flipper-mcp A Rust MCP Model Context Protocol server that runs directly on the Flipper Zero's WiFi Dev Board v1 ESP32-S2, enabling AI agents to control a Flipper Zero over the network. What is this? This project puts an MCP server on the Flipper itself. Any MCP-compatible AI client Claude Desktop...

Security Bulletin: IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI [CVE-2026-96119]

Summary IBM i is vulnerable to allowing a remote authenticated attacker to execute arbitrary code due to improper data sanitization CVE-2026-96119 in HTTP Server Administration Graphical User Interface GUI as described in the vulnerability details section. Vulnerability Details ID: CVE-2026-96119...

SUSE CVE-2026-100347

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation...

libsoup security update

An update is available for libsoup. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libsoup packages provide an HTTP client and server library for GNOME...

OESA-2026-4365 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version...

OESA-2026-4366 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version...

OESA-2026-4364 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version...

CVE-2026-76184

A flaw was found in Eclipse Jetty's HttpClient. When handling HTTP redirects containing path traversal sequences, the client fails to normalize the destination path before matching stored authentication credentials. A remote attacker who controls redirect responses can exploit this issue to cause...

CVE-2026-100822

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Spoofing issue in the Networking: HTTP component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

Security update for libsoup

This update for libsoup fixes the following issues: CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711:...

SUSE-SU-2026:4690-1 Security update for libsoup

This update for libsoup fixes the following issues: - CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch bsc1272195. - CVE-2026-15711:...

BIT-GOLANG-2026-97032 HTTP/2 server crash due to HPACK encoder race in net/http

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

BIT-GOLANG-2026-94439 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...