CVE-2026-92790 Higress before 2.2.4 Rate Limit Bypass via Malformed Cookie Header

Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed...

EUVD-2026-81079

Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and d...

CVE-2026-77360

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

CVE-2026-77360 oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

CVE-2026-77360 oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

CVE-2026-77360

oRPC is a tool for building type-safe APIs adhering to OpenAPI standards. Prior to 1.14.8 , the @orpc/server CORS plugin (packages/server/src/plugins/cors.ts) copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin fo...

CVE-2026-77360 oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

CVE-2026-85732

A flaw was found in oras-go, a Go library for managing OCI artifacts. This vulnerability allows a remote attacker to perform blind Server-Side Request Forgery SSRF against internal services by providing a specially crafted Link header URL during pagination operations. Although the response body i...

CVE-2026-85732

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...

DEBIAN-CVE-2026-85732

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...

GO-2026-6463 rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone...

GO-2026-6451 webhookd: Unrestricted HTTP Header to Shell Variable Injection in github.com/ncarlier/webhookd

webhookd: Unrestricted HTTP Header to Shell Variable Injection in github.com/ncarlier/webhookd...

GO-2026-6455 Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik

Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik...

CVE-2026-85732

oras-go (a Go library for managing OCI artifacts) prior to 2.6.2 contains a blind SSRF vulnerability in the parseLink function within registry/remote/utils.go. The function accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port, causin...

CVE-2026-85732 oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...

CVE-2026-85732 oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...

Updated python-h2 packages fix a security vulnerability

Duplicate Host header facilitate request smuggling. CVE-2026-71554...

MGASA-2026-0409 Updated python-h2 packages fix a security vulnerability

Duplicate Host header facilitate request smuggling. CVE-2026-71554...

SUSE CVE-2026-79699

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...

SUSE CVE-2026-92238

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...