PT-2026-114313

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An issue exists during the HSTS cache import process where importing a parent HSTS entry with the includeSubDomains flag before a longer-lived child entry causes the child entry to be silently...

PT-2026-113943

Name of the Vulnerable Software and Affected Versions Dgraph versions prior to 25.4.0 Description Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. A remote unauthenticated attacker with access to the Zero HTTP port...

PT-2026-114013

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

PT-2026-113982

Name of the Vulnerable Software and Affected Versions bandit versions 1.4.0 and later Description Uncontrolled resource consumption allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely. By sending a trickle of small WINDOW UPDATE frames or empty SETTINGS frames, a...

PT-2026-113742

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An HTTP proxy can trick libcurl into sending the origin's credentials, such as Basic passwords or Negotiate/Kerberos tickets, directly to the proxy. This occurs when the proxy responds to a...

PT-2026-113740

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A remote HTTP server can set a cookie that is accepted and written to a Netscape cookie jar but cannot be reloaded. When curl is subsequently invoked using the same path for the --cookie and...

PT-2026-114355

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A flaw exists in the ngx http v3 module module. When HTTP/3 is used in conjunction with the proxy request buffering directive set to on, a...

CVE-2026-109527: Allocation of Resources Without Limits or Throttling

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130102)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130102 advisory. Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130123)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130123 advisory. Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through...

Linux Distros Unpatched Vulnerability : CVE-2026-95101

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an...

Linux Distros Unpatched Vulnerability : CVE-2026-92392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130139)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130139 advisory. Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache...

CVE-2026-92392: Use After Free

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

Quarkus Java Framework Data Compromise

The vulnerability of the Quarkus framework is related to incorrect interpretation of HTTP requests. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of the protected information...

PT-2026-114229

Name of the Vulnerable Software and Affected Versions mcp versions 1.8.0 through 1.29.9 mcp versions 2.0.0 through 2.1.9 Description Stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable http app, and StreamableHTTPSessionManager, retain session entries without an idle...

PT-2026-114182

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.79.0 Description An issue exists where users can trigger server-side request forgery, a flaw that allows a server to be coerced into making requests to an unintended location. This occurs when the shared HTTP clie...

PT-2026-114179

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.60.1 Description An allowlist bypass exists that enables repository users to circumvent the allowedHeaders restriction. This occurs when hostRules headers are placed within shared presets. An attacker can provide...

PT-2026-114020

Name of the Vulnerable Software and Affected Versions mcp versions prior to 1.29.1 mcp versions 2.0.0a1 through 2.0.1 Description The Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. ...

PT-2026-114149

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description An HTTP header injection issue exists in the proxy component. This occurs because a lone Line Feed LF character within the target portion of a routing token, specifically in the Cookie: msts=...