EUVD-2026-108958

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL spe...

httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest

A flaw was found in the modauthdigest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of...

Astra Linux – Vulnerability in Twisted

Twisted is an event-driven networking engine written in Python. In affected versions, Twisted exposes cookies and authorization headers when performing cross-origin redirects. This issue is present in the twited.web.RedirectAgent and twisted.web.BrowserLikeRedirectAgent functions. Users are advis...

tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects

A flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect to a different origin, the client improperly retains and forwards sensitive authentication credentials, such as Authorization headers, to the new, potentially untrusted, destination. This vulnerability allows a remote...

CVE-2026-107232

A flaw was found in AsyncHttpClient. When an HTTP proxy rejects an HTTPS CONNECT request, the client can incorrectly treat the still-plaintext connection to the proxy as an established tunnel. A subsequent proxy authentication challenge or redirect can cause the client to resend the origin reques...

DEBIAN-CVE-2026-107714

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

CVE-2026-107714: Exposure of Sensitive Information to an Unauthorized Actor

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

BIT-APACHE-2026-48005 Apache HTTP Server: mod_auth_digest reauthentication attack

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...

SUSE CVE-2026-48005

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...

httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest

A flaw was found in the modauthdigest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of...

CVE-2026-48005

A flaw was found in the modauthdigest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-48005

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote...

DEBIAN-CVE-2026-48005

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...

CVE-2026-48005

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...

UBUNTU-CVE-2026-48005

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...

CVE-2026-48005

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...

CVE-2026-48005

The Apache Software Foundation Apache HTTP Server (versions before 2.4.69 ) on all platforms is vulnerable to a denial of service (forced re-authentication) via a missing authentication check in mod_auth_digest . An unauthenticated remote client can trigger this by sending forged Authorization he...

CVE-2026-48005 Apache HTTP Server: mod_auth_digest reauthentication attack

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...

EUVD-2026-90892

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...

CVE-2026-48005

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...