PT-2026-117364

Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...

RHEL 8 : pcs (RHSA-2026:85135)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:85135 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado:...

RHEL 8 : pcs (RHSA-2026:84844)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84844 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado:...

openSUSE 16 Security Update : go1.27 (openSUSE-SU-2026:22093-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22093-1 advisory. Update to go1.27.2 bsc1272545: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. - CVE-2026-56866:...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Apache HTTP Server vulnerabilities (USN-8931-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8931-1 advisory. discovered that Apache HTTP Server exposed WebDAV property information. A remote...

Linux Distros Unpatched Vulnerability : CVE-2026-112006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verificatio...

openSUSE 16 Security Update : go1.26 (openSUSE-SU-2026:22095-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22095-1 advisory. Update to go 1.26.9 bsc1255111: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. - CVE-2026-56866...

RHEL 8 : pcs (RHSA-2026:84843)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84843 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado:...

RHEL 8 : pcs (RHSA-2026:84798)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84798 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado:...

cve-2023-44487-POC

cve-2023-44487 - http/2 rapid reset attack by 7pirqte what is this poc for the http/2 rapid reset attack. basically you open a stream with HEADERS frame then immediatly send RSTSTREAM to cancel it. server does all the work setting up and tearing down streams while you just spam requests. the...

CVE-2026-105661

Requesting /username/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for ea...

CVE-2026-105661 Gitea panic on the repositories route of individual users

Requesting /username/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for ea...

CVE-2026-105661 Gitea panic on the repositories route of individual users

Requesting /username/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for ea...

CVE-2026-105661

The Gitea platform is vulnerable to a NULL pointer dereference (CWE-476) and an uncaught exception (CWE-248). When an unauthenticated user requests /{username}/-/repositories for an individual user instead of an organization, the organization home handler dereferences a nil organization object. T...

CVE-2026-109553 Gitea SSH certificate principal impersonation of other users

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSHTRUSTEDUSERCAKEYS and accepts arbitrary principals SSHAUTHORIZEDPRINCIPALSALLOW=anything, a user could register...

CVE-2026-109553 Gitea SSH certificate principal impersonation of other users

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSHTRUSTEDUSERCAKEYS and accepts arbitrary principals SSHAUTHORIZEDPRINCIPALSALLOW=anything, a user could register...

CVE-2026-109553

The Gitea SSH server is vulnerable to principal impersonation due to an incorrect logic in how it resolves SSH certificate principals. The software incorrectly searches the content of all stored public keys instead of only the principal keys. This issue occurs when Gitea trusts a user certificate...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ https://github.com/user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74 Overview CVE-2026-49975 is a Denial of Service DoS vulnerability in Apache HTTP Server. The vulnerability occurs in the HTTP/2 request handling path, where...

[SECURITY] [DLA 4842-1] haproxy security update

Debian LTS Advisory DLA-4842-1 [email protected] https://www.debian.org/lts/security/ Santiago Ruano Rincón October 18, 2026 https://wiki.debian.org/LTS Package : haproxy Version : 2.6.12-1+deb12u4 CVE ID : CVE-2026-33555, not yet available Three vulnerabilities were discovered in...

CVE-2026-80343

CVE-2026-80343 — camel-netty-http: security-constraint case-sensitivity bypass Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match, while t...