CVE-2026-95101

A flaw was found in NGINX. When HTTP/3 is used with proxy request buffering enabled, an unauthenticated remote attacker can inject arbitrary data into proxied requests. This vulnerability allows an attacker to manipulate traffic forwarded to backend servers, compromising data integrity. Mitigatio...

CVE-2026-78222

A flaw was found in NGINX. A remote attacker, by sending a specially crafted HTTP response to ngx.fetch, can cause an NGINX worker to crash when trusted JavaScript attempts to read the Response.statusText. This vulnerability requires the attacker to have control or influence over the fetched HTTP...

DoS (Denial of Service) io.netty:netty-codec-http Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

DoS (Denial of Service) io.netty:netty-codec-http Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

DoS (Denial of Service) org.apache.httpcomponents.core5:httpcore5 Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

DoS (Denial of Service) org.apache.httpcomponents.core5:httpcore5-h2 Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

MITM (Man-in-the-Middle) axios Dependency in Crowd Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in version 7.2.0 of Crowd Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 7.2 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N allows an unauthenticated attacker to potentially...

DEBIAN-CVE-2026-111750

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTPNOEXTENSIONS or otherwise runs without a...

CVE-2026-111750

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTPNOEXTENSIONS or otherwise runs without a...

CVE-2026-111750

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTPNOEXTENSIONS or otherwise runs without a...

CVE-2026-111750

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTPNOEXTENSIONS or otherwise runs without a...

CVE-2026-111750

The AIOHTTP asynchronous HTTP client/server framework for Python and asyncio is vulnerable to HTTP request smuggling in versions prior to 3.14.4 . The issue stems from a pure Python parser that accepts ambiguous HTTP request framing. An unauthenticated attacker can smuggle requests if an applicat...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the HTTP request parser's handling of absolute-form request targets, where the scheme supplied in the request URL is trusted without validation. When aiohttp is used as a reverse proxy or in a configuratio...

Exploit for CVE-2026-85254

CVE-2026-85254 — camel-platform-http: request-header echo supp...

OPENSUSE-SU-2026:22135-1 Security update for coredns

This update for coredns fixes the following issues: Changes in coredns: - Bump vendored google.golang.org/grpc from 1.83.0 to 1.83.1: CVE-2026-84304: heap memory exhaustion via HTTP/2 DATA frame fragmentation in the gRPC transport boo1279216 Done through the gomodules "require" parameter in servi...

SUSE CVE-2026-112077

A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function rcorecmdstrpipe in the library libr/core/rtrhttp.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the attack ...

Exploit for CVE-2026-85251

CVE-2026-85251 — camel-http: credential disclosure on redirect...

Security Bulletin: IBM Virtualization Engine TS7700 is susceptible to a denial of service vulnerability due to the use of IBM® WebSphere® Liberty

Summary IBM Virtualization Engine TS7700 is susceptible to a denial of service vulnerability CVE-2026-14981 due to the use of IBM WebSphere Liberty. An attacker could cause a denial of service condition in the HTTP channel through uncontrolled resource consumption. TS7700 uses WebSphere Liberty t...

Oracle Payroll security vulnerability

Oracle Payroll versions 12.2.3 to 12.2.15 have security vulnerabilities. These vulnerabilities stem from issues with the Internal Operations component, which may allow low-privilege attackers to take control of Oracle Payroll through HTTP network access...