CVE-2026-70188

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

RHLW-2026-C317E2781FF17B2F Lightwell Security Advisory: jetty-http 12.0.32.rhlw-00002

Red Hat Lightwell has released org.eclipse.jetty:jetty-http 12.0.32.rhlw-00002 with a backported security fix. CVE-2026-2332: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing This patched artifact is a drop-in replacement for org.eclipse.jetty:jetty-http 12.0.32 from Maven Centr...

CVE-2026-106176

A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests...

CVE-2026-106170

An Uncaught Exception vulnerability CWE-248 vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests...

CVE-2026-106172

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker...

CVE-2025-57739

An improper neutralization of special elements used in an SQL Command "SQL Injection" vulnerability CWE-89 vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or command...

CVE-2026-106172

Fortinet FortiSandbox and FortiSandbox Cloud products are vulnerable to a use of hard-coded cryptographic key (CWE-321). This vulnerability affects FortiSandbox versions 5.2.0 through 5.2.1 , 5.0.0 through 5.0.6 , and all 4.4 versions , as well as FortiSandbox Cloud versions 5.2.0 through 5.2.1 ,...

CVE-2026-106172

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker...

CVE-2026-106172

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker...

CVE-2025-57739

An SQL Injection vulnerability (CWE-89) exists in Fortinet FortiMail versions 7.6.0 through 7.6.3 , 7.4.0 through 7.4.5 , and 7.2.0 through 7.2.8 . The flaw is caused by an improper neutralization of special elements used in an SQL command. This allows an authenticated attacker to execute unautho...

CVE-2026-106170

An Uncaught Exception vulnerability (CWE-248) exists in Fortinet FortiSandbox versions 5.2.0 through 5.2.1 , 5.0.0 through 5.0.6 , and all versions of 4.4 . A privileged attacker can use crafted HTTP requests to persistently deny access to the GUI and CLI . No specific exploit details or remediat...

CVE-2026-106176

A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests...

CVE-2026-106176

A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 allows an attacker to execute unauthorized code or commands by sending specially crafted HTTP requests . The vulnerability is associated with CWE-862 and has a LOW base severity score of 3.8. No specific exploit details or remediat...

CVE-2026-106176

A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests...

EUVD-2026-98967

A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests...

Security Bulletin: An IBM QRadar SIEM HTTP Receiver protocol is vulnerable to a denial of service, SQL injection and could allow a remote attacker to execute arbitrary code on the system.

Summary IBM QRadar when using the HTTP Receiver protocol could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. Vulnerability Details CVEID:CVE-2026-93441 DESCRIPTION: IBM QRadar could allow a remote attacker to cause a denial of service due to...

CVE-2026-61642

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

AZL-108531 CVE-2026-61642 affecting package squid 6.13-5

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

UBUNTU-CVE-2026-61642

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

SUSE-SU-2026:4651-1 Security update for php8

This update for php8 fixes the following issues: - CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser bsc1282981. - CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing bsc1283216. - CVE-2026-6103: Archive entry injection via...