CLEANSTART-2026-IB07435 Vulnerability in core of Apache HTTP Server 2

Security vulnerability affects the apache2 package. Vulnerability in core of Apache HTTP Server 2...

CLEANSTART-2026-OB27244 Encoding problem in mod_proxy in Apache HTTP Server 2

Security vulnerability affects the apache2 package. Encoding problem in modproxy in Apache HTTP Server 2...

CLEANSTART-2026-QV20553 SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2

Security vulnerability affects the apache2 package. SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2...

CLEANSTART-2026-RW47407 Substitution encoding issue in mod_rewrite in Apache HTTP Server 2

Security vulnerability affects the apache2 package. Substitution encoding issue in modrewrite in Apache HTTP Server 2...

CLEANSTART-2026-WF86343 Potential SSRF in mod_rewrite in Apache HTTP Server 2

Security vulnerability affects the apache2 package. Potential SSRF in modrewrite in Apache HTTP Server 2...

CLEANSTART-2026-XP17348 null pointer dereference in mod_proxy in Apache HTTP Server 2

Security vulnerability affects the apache2 package. null pointer dereference in modproxy in Apache HTTP Server 2...

CLEANSTART-2026-PP94302 HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack

Security vulnerability affects the apache2 package. HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack...

CLEANSTART-2026-CF08389 regression in the core of Apache HTTP Server 2

Security vulnerability affects the apache2 package. A regression in the core of Apache HTTP Server 2...

CLEANSTART-2026-JH66547 Improper escaping of output in mod_rewrite in Apache HTTP Server 2

Security vulnerability affects the apache2 package. Improper escaping of output in modrewrite in Apache HTTP Server 2...

CLEANSTART-2026-BD98589 partial fix for  CVE-2024-39884 in the core of Apache HTTP Server 2

Security vulnerability affects the apache2 package. A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2...

CLEANSTART-2026-ZC63840 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

CVE-2026-39827 affects multiple packages. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See references for individual vulnerability details...

CLEANSTART-2026-SG10675 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...

CLEANSTART-2026-WU57451 When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...

CVE-2026-39828 affects multiple packages. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. See reference...

CLEANSTART-2026-BD72670 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

CVE-2026-46595 affects multiple packages. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. See references for individual vulnerability...

CLEANSTART-2026-UZ23021 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the temporal-server-fips package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

EUVD-2026-95428

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

PT-2026-109199

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-106155: Improper Neutralization of Input During Web Page Generation

In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views t...

CVE-2026-106145: Incorrect Privilege Assignment

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server...

CVE-2026-39453: Reachable Assertion

Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots...