CVE-2026-97057

A flaw was found in redis-parser. This vulnerability allows a malicious or compromised Redis endpoint to trigger an uncaught RangeError by sending a crafted RESP REdis Serialization Protocol header with an excessively large declared length. The flaw occurs because redis-parser fails to validate t...

CVE-2026-67405

A flaw was found in RabbitMQ's Web-MQTT and Web-STOMP handlers. These handlers do not properly validate the Origin header during a WebSocket upgrade. When specific non-default configurations are enabled, such as usehttpauth=true for Web-STOMP or sslcertlogin=true for both plugins, an attacker can...

MAL-2026-17154 Malicious code in @nf-addons/am-global-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f4f7297a2ae76eee65506183462a7138df6115ee2bfad9c84878b7f3c7998c8 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That module reads os.userInfo.usernam...

Malicious code in @nf-addons/am-global-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f4f7297a2ae76eee65506183462a7138df6115ee2bfad9c84878b7f3c7998c8 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That module reads os.userInfo.usernam...

CVE-2026-88916 Admin Access Bypass via Header Fallback in TÜBİTAK ULAKBİM's UlakPDF

Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation. This issue affects UlakPDF: through 09092026...

CVE-2026-88916 Admin Access Bypass via Header Fallback in TÜBİTAK ULAKBİM's UlakPDF

Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation. This issue affects UlakPDF: through 09092026...

CVE-2026-88916

TÜBİTAK ULAKBİM UlakPDF is susceptible to an Incorrect Authorization vulnerability, which allows for Privilege Escalation . Specifically, an Admin Access Bypass can occur due to a Header Fallback mechanism in the software. This issue affects versions up to 09092026 . The vulnerability has a CVSS ...

exploitation-labs

Icecast 2.0.1 Header Overwrite — Windows 7 CVE: CVE-2004-...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

Denial Of Service

Apache CXF is vulnerable to Denial Of Service. The vulnerability is due to incomplete mitigation of attachment-header processing, allowing an attacker to send a message containing many attachment headers and cause excessive resource consumption...

EUVD-2026-85786

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

USN-8811-1: urllib3 vulnerability

It was discovered that urllib3 did not correctly strip sensitive HTTP headers during cross-origin redirects. An attacker could possibly use this issue to leak sensitive information...

USN-8811-1 python-urllib3 vulnerability

It was discovered that urllib3 did not correctly strip sensitive HTTP headers during cross-origin redirects. An attacker could possibly use this issue to leak sensitive information...

PT-2026-97822

Name of the Vulnerable Software and Affected Versions mcp-remote versions 0.1.32 through 0.1.38 Description The software is subject to Server-Side Request Forgery SSRF, a flaw that allows a server to make requests to an unintended location. This occurs because the application trusts and fetches t...

PT-2026-97852

Name of the Vulnerable Software and Affected Versions OpenStack Zaqar versions prior to 22.0.2 Description WSGI transport mishandles the URL-Signature header. An unauthenticated remote attacker who knows a target project's UUID can bypass Keystone authentication and pre-signed URL verification by...

PT-2026-97928

Name of the Vulnerable Software and Affected Versions libsndfile version 1.2.2 Description An integer overflow occurs in the mat4 read header function when the software parses specially crafted MAT4 MATLAB v4 files. Recommendations At the moment, there is no information about a newer version that...

EUVD-2026-86017

mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery SSRF via the resourcemetadata URL extracted from a remote MCP server's WWW-Authenticate header...

CVE-2026-51994

mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery SSRF via the resourcemetadata URL extracted from a remote MCP server's WWW-Authenticate header...

PT-2026-98291

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An out-of-bounds read occurs in the HTTP stream wrapper when following a redirect where the response contains a Location header with an empty value. The redirect...