CVE-2026-101057

utcp-mcp the MCP plugin of python-utcp through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensuresecureurl validation that the HTTP-family plugins apply, so the HTTPS/WSS-or-loopback rule is not enforced. A call template...

CVE-2026-100860

The software heym before version 0.0.105 contains an Authentication Bypass vulnerability in the Redis workflow node (backend/app/services/node_execution/nodes/redis_node.py). The root cause is that the application fails to act on the result of credential authorization lookups; if _get_accessible_...

CVE-2026-100860 heym before 0.0.105 Authentication Bypass via Redis Node

heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node backend/app/services/nodeexecution/nodes/redisnode.py. When getaccessiblecredential returns None — because the credential ID does not exist or the caller is not authorized to use it —...

CVE-2026-100860 heym before 0.0.105 Authentication Bypass via Redis Node

heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node backend/app/services/nodeexecution/nodes/redisnode.py. When getaccessiblecredential returns None — because the credential ID does not exist or the caller is not authorized to use it —...

SUSE CVE-2026-96747

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

DEBIAN-CVE-2026-100666

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

CVE-2026-100666

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

UBUNTU-CVE-2026-100666

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

CVE-2026-100666

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

CVE-2026-100666 Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

CVE-2026-100666

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

CVE-2026-100666 Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

EUVD-2026-87760

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

CVE-2026-100658

Removed by vendor...

CVE-2026-100666: Inconsistent Interpretation of HTTP Requests

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

PT-2026-99337

Name of the Vulnerable Software and Affected Versions Netty HttpServerCodec versions 4.2.0.Final through 4.2.16.Final Netty HttpServerCodec versions prior to 4.1.137.Final Description Netty's HttpServerCodec pairs outbound responses with inbound requests by calling the pollMethod function once pe...

PT-2026-99366

Name of the Vulnerable Software and Affected Versions Adminer versions prior to 6.0.2 Description An issue exists where the result of the CONNECTION ID database function is interpolated into JavaScript without proper escaping. This allows a malicious database server to execute arbitrary JavaScrip...

SUSE CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

SUSE CVE-2026-98162

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree connection leak in smb2treeconnect See the procedure below: smb2treeconnect ksmbdtreeconnconnect xastore&sess-treeconns, treeconn-id, treeconn ksmbdcounterincKSMBDCOUNTERTREECONNS ksmbdsharetreeconnincsc...

EUVD-2026-87248

A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped...