CVE-2026-93750

http-cache-semantics (npm) through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients and receive cached respons...

CVE-2026-93748

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives. An unauthenticated attacker can request the same URL with a large max-stale value to retrieve another user's Set-Cookie session credentials from shared-cache en...

CVE-2026-93748 http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

CVE-2026-93748

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

CVE-2026-93748 http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

CVE-2026-93748

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

EUVD-2026-83253

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

grafana: Grafana: Session takeover via Auth Proxy cache key collision

On instances using Auth Proxy header authentication auth.proxy with identity caching enabled syncttl 0, two distinct user identities could produce the same cache key. An authenticated low-privileged user able to influence their own forwarded identity attributes could be served a higher-privileged...

DEBIAN-CVE-2026-93569

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

CVE-2026-93569

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

UBUNTU-CVE-2026-93569

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

CVE-2026-93569 Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

WordPress Breeze Cache plugin 1.2.5-2.5.14 - Unauthenticated Cache Poisoning vulnerability

Unauthenticated Cache Poisoning vulnerability discovered by Amity Gilmour in WordPress Plugin Breeze versions 1.2.5-2.5.14...

CVE-2026-15743

A flaw was found in Catalyst::Plugin::Static::Simple for Perl. The servestatic method incorrectly sets the Cache-Control header to "public" for all responses. This misconfiguration allows intermediate proxies to store sensitive content, including responses from authenticated sessions, in shared...

Exploit for Improper Validation of Consistency within Input in Linux Linux_Kernel

Copy Fail CVE-2026-31431 – Exploit Usage Guide https://git...

CLEANSTART-2026-DK58903 Security fix for GHSA-527x-5wrf-22m2 applied in: kubernetes-dns-node-cache 1.26.7-r0, kubernetes-dns-node-cache-fips 1.26.7-r0

GHSA-527x-5wrf-22m2 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KZ65152 Security fix for GHSA-h75p-j8xm-m278 applied in: kubernetes-dns-node-cache 1.26.7-r1, kubernetes-dns-node-cache-fips 1.26.0-r1, kubernetes-dns-node-cache-fips 1.26.7-r1

GHSA-h75p-j8xm-m278 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TH82276 Security fix for GHSA-c9v3-4pv7-87pr applied in: kubernetes-dns-node-cache 1.26.7-r1, kubernetes-dns-node-cache-fips 1.26.7-r1

GHSA-c9v3-4pv7-87pr affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OT08451 Security fix for CVE-2026-40898 applied in: kube-metrics-adapter 0.2.9-r0, kubernetes-dns-node-cache 1.23.1-r0, kubernetes-dns-node-cache 1.24.1-r1, kubernetes-dns-node-cache 1.25.0-r8, kubernetes-dns-node-cache 1.26.0-r1, prometheus-blackbox-exporter 0.28.0-r2

CVE-2026-40898 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UC10506 Security fix for CVE-2026-32934 applied in: coredns 1.14.2-r1, kubernetes-dns-node-cache 1.23.1-r0, kubernetes-dns-node-cache 1.24.1-r1, kubernetes-dns-node-cache 1.25.0-r8, kubernetes-dns-node-cache 1.26.0-r1, kubernetes-dns-node-cache-fips 1.26.0-r1

CVE-2026-32934 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...