EUVD-2026-12559

A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where...

crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate

A flaw was found in golang. A remote attacker could exploit this vulnerability by providing a specially crafted certificate during the error string construction process within the HostnameError.Error function. This flaw, caused by unbounded string concatenation, leads to excessive resource...

AZL-80229 CVE-2026-3632 affecting package libsoup 3.4.4-16

A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where...

CVE-2026-3632

A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where...

Curl 7.33.0 < 8.19.0 Token Leak with Redirect and Netrc

The version of curl installed on the remote host is 7.33.0 prior to 8.19.0. It is, therefore, affected by a token leak with redirect and netrc vulnerability: - When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a redirect to a second URL, curl could leak that...

libsoup 安全漏洞

Libsoup is a GNOME project’s HTTP client/server library. Libsoup has a security vulnerability that stems from improper validation of hostnames. This allows special characters to be injected into HTTP headers, potentially enabling remote attackers to execute HTTP requests with malicious payloads,...

CVE-2026-3632: Improper Validation of Syntactic Correctness of Input

A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where...

EUVD-2026-12208

A vulnerability was found in Wavlink WL-NU516U1 240425. The impacted element is the function sub404F68 of the file /cgi-bin/login.cgi. The manipulation of the argument homepage/hostname results in cross site scripting. The attack can be launched remotely. The exploit has been made public and coul...

CVE-2026-4166

A vulnerability was found in Wavlink WL-NU516U1 240425. The impacted element is the function sub404F68 of the file /cgi-bin/login.cgi. The manipulation of the argument homepage/hostname results in cross site scripting. The attack can be launched remotely. The exploit has been made public and coul...

Malicious code in internal-lib-vulnerable (npm)

Malicious package due to data exfiltration, arbitrary code execution during installation via preinstall script, and suspicious hostname. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b46f6c2b8b094dc4a9864676457c3ea2af565204d854ab4cf1eb27be87aaa878 The package...

MAL-2026-1484 Malicious code in internal-lib-vulnerable (npm)

Malicious package due to data exfiltration, arbitrary code execution during installation via preinstall script, and suspicious hostname. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b46f6c2b8b094dc4a9864676457c3ea2af565204d854ab4cf1eb27be87aaa878 The package...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2026-1578)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.CVE-2025-58185 When Conn.Handshake fai...

EulerOS 2.0 SP10 : golang (EulerOS-SA-2026-1310)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the...

WAVLINK WL-NU516U1 代码注入漏洞

WAVLINK WL-NU516U1 is a wireless print server developed by WAVLINK Corporation. The version 240425 of WAVLINK WL-NU516U1 has a code injection vulnerability. This vulnerability stems from incorrect handling of parameters homepage/hostname in the function sub404F68 within the file /cgi-bin/login.cg...

CVE-2026-32627: Improper Certificate Validation

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and setfollowlocationtrue, any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2026-1606)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.CVE-2025-58185 When Conn.Handshake fai...

OESA-2026-1634 util-linux security update

The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fixes: A vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.CVE-2026-3184...

OESA-2026-1633 util-linux security update

The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fixes: A vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.CVE-2026-3184...

CVE-2026-4166

A vulnerability was found in Wavlink WL-NU516U1 240425. The impacted element is the function sub404F68 of the file /cgi-bin/login.cgi. The manipulation of the argument homepage/hostname results in cross site scripting. The attack can be launched remotely. The exploit has been made public and coul...

CVE-2026-32627 cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and setfollowlocationtrue, any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new...