CVE-2022-22836

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:00+00:00| seen| https://t.me/hackingAttack/38115 2026-09-02 01:02:22+00:00| seen| https://t.me/hackingAttack/38115 2026-09-06 16:00:05+00:00| published-proof-of-concept| https://t.me/hackingAttack/38115 2026-09-07 01:00:10+00:00|...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-125)

Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service Improper Handling of Highly Compressed Data CWE-409 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding Streams management privileges could supply specially...

httpd: incomplete fix for CVE-2023-38709

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...

EUVD-2026-54577

Kirby: System path exposure from error messages in the REST API...

CVE-2026-84232

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...

CVE-2026-84232 Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...

EUVD-2026-69293

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...

CVE-2026-84232

CVE-2026-84232 is a stored cross-site scripting (XSS) vulnerability in pulpcore's content serving application (python-pulpcore). The root cause is that files uploaded to Pulp file-type repositories are served with their original MIME type (e.g., text/html, image/svg+xml) and without a Content-Dis...

CVE-2026-84232 Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...

CVE-2026-84232

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...

AZL-98481 CVE-2026-71562 affecting package erlang for versions less than 26.2.5.21-6

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...

CVE-2026-71380

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

CVE-2026-71562

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...

DEBIAN-CVE-2026-71380

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

CVE-2026-71380

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

UBUNTU-CVE-2026-71380

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

WordPress Divi plugin <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Dynamic Content Legacy JSON Format Shortcode vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Theme Divi versions = 4.27.6...

CVE-2026-73812

Erlang/OTP inets (HTTP server module) is vulnerable to HTTP Request Smuggling (CL.TE desync) when deployed behind a Content-Length-preferring front-end proxy. The root cause is in httpd:check_header/3 , which rejects duplicate Content-Length headers but never validates the simultaneous presence o...

EUVD-2026-69235

httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...

CVE-2026-73812 inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length

httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...