CLEANSTART-2026-IB07435 Vulnerability in core of Apache HTTP Server 2

Security vulnerability affects the apache2 package. Vulnerability in core of Apache HTTP Server 2...

CLEANSTART-2026-RW47407 Substitution encoding issue in mod_rewrite in Apache HTTP Server 2

Security vulnerability affects the apache2 package. Substitution encoding issue in modrewrite in Apache HTTP Server 2...

CLEANSTART-2026-XP17348 null pointer dereference in mod_proxy in Apache HTTP Server 2

Security vulnerability affects the apache2 package. null pointer dereference in modproxy in Apache HTTP Server 2...

CLEANSTART-2026-BD98589 partial fix for  CVE-2024-39884 in the core of Apache HTTP Server 2

Security vulnerability affects the apache2 package. A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2...

CLEANSTART-2026-QV20553 SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2

Security vulnerability affects the apache2 package. SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2...

CLEANSTART-2026-ZC63840 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

CVE-2026-39827 affects multiple packages. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See references for individual vulnerability details...

CLEANSTART-2026-BD72670 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

CVE-2026-46595 affects multiple packages. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. See references for individual vulnerability...

CLEANSTART-2026-WU57451 When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...

CVE-2026-39828 affects multiple packages. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. See reference...

CLEANSTART-2026-SG10675 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...

CLEANSTART-2026-UZ23021 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the temporal-server-fips package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

EUVD-2026-95428

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

PT-2026-108827

Name of the Vulnerable Software and Affected Versions Zombify versions prior to 1.7.8 Description An unrestricted upload of files with dangerous types allows an attacker to upload a web shell to the web server. A web shell is a malicious script that enables remote administration of the compromise...

CVE-2026-107824: Missing Authentication for Critical Function

x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...

CVE-2026-108158: Improper Limitation of a Pathname to a Restricted Directory

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...

PT-2026-109199

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-109148

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server...

PT-2026-108963

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.x Description Nginx UI contains a cross-site request forgery CSRF flaw where the AuthRequired middleware accepts a browser-managed cookie named token as a valid API credential. Because management endpoints d...

Rocky Linux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1791559300)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791559300 advisory. - A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different conte...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.2:CLSA-2026:1791536084)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791536084 advisory. - Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS8.5:CLSA-2026:1791552137)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791552137 advisory. - A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untruste...