CVE-2026-94194: Inconsistent Interpretation of HTTP Requests

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning the responses to subsequent requests that share the connection...

PT-2026-99953

Name of the Vulnerable Software and Affected Versions ip-address versions 10.2.0 through 10.5.0 Description The Address6.isPrivate classifier in src/ipv6.ts fails to recognize the NAT64 local-use range 64:ff9b:1::/48. Consequently, the isPrivate, isLoopback, and isLinkLocal functions return false...

PT-2026-99841

Name of the Vulnerable Software and Affected Versions TPVEnlanube affected versions not specified Description An authenticated attacker can perform Stored Cross-Site Scripting XSS, which occurs when a malicious script is permanently stored on the target server. This allows the execution of...

CVE-2026-7171: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS in TPVEnlanube affecting the following endpoint and parameter: CVE-2026-7171: parameter 'Apellido 1' in the endpoint '/administrator/index.php?page=admin.useradd&userid=45&option=comvirtuemart'. Successful exploitation of this vulnerability could allow an...

CLSA-2026-1790544295 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.4-tuxcare.1...

CLSA-2026-1790542520 TuxCare security update for undici (1 CVE)

TuxCare rebuilt undici to address 1 CVE. Fixed in 7.28.0-tuxcare.1...

CLSA-2026-1790542220 TuxCare security update for undici (12 CVEs)

TuxCare rebuilt undici to address 12 CVEs. Fixed in 6.19.7-tuxcare.1...

CLSA-2026-1790541916 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.18.3-tuxcare.1...

CLSA-2026-1790541906 TuxCare security update for bn.js (1 CVE)

TuxCare rebuilt bn.js to address 1 CVE. Fixed in 4.11.9-tuxcare.1...

CLSA-2026-1790541875 TuxCare security update for stream-json (1 CVE)

TuxCare rebuilt stream-json to address 1 CVE. Fixed in 1.9.1-tuxcare.1...

CLSA-2026-1790520930 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.3-tuxcare.1...

CVE-2026-75758

A flaw was found in the Elixir standard library. An attacker who controls a list can trigger an uncontrolled recursion vulnerability by passing a specially crafted list to functions like inspect/1, List.tostring/1, or List.tocharlist/1. This leads to the exhaustion of a BEAM node's memory,...

CVE-2026-100663

A flaw was found in Netty's HTTP/3 codec netty-codec-http3. A remote attacker can bypass security policies and tunnel allowlists when Netty acts as an HTTP/1 to HTTP/3 proxy or gateway. Due to improper translation of HTTP/1 CONNECT requests, the component uses the attacker-controlled Host header ...

CVE-2026-72662

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user granted the Timeline feature privilege in a Kibana space could...

CVE-2026-72662 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user granted the Timeline feature privilege in a Kibana space could...

CVE-2026-72662 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user granted the Timeline feature privilege in a Kibana space could...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in HttpConversionUtil.toHttp3HeadersHttpMessage, boolean, which has no special case for HTTP/1 CONNECT and instead runs the generic request conversion, drawing :authority from the Host header rather than the...

CVE-2026-100664

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

UBUNTU-CVE-2026-100663

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

CVE-2026-100663

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...