UBUNTU-CVE-2026-101899

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NOPROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NOPROXY while a proxy is...

PT-2026-115210

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while...

PT-2026-115209

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

PT-2026-115119

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handle...

CVE-2026-101899

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NOPROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NOPROXY while a proxy is...

CVE-2026-102476

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and...

CVE-2026-102476

The io.vertx:vertx-core component in Eclipse Vert.x versions [5.0.0, 5.0.12] , [5.1.0, 5.1.9] , and [5.2.0, 5.2.0] is vulnerable to a security flaw in the Vert.x HTTP client . The root cause is an inefficient SSL context cache where the cache key does not fully reflect the SSL semantics of the de...

CVE-2026-60021

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request...

CVE-2026-60021

Gitea is vulnerable to an uncontrolled resource consumption flaw during the initial GitLab migration version probe . The application uses an HTTP client without a timeout and fails to attach the migration task's cancellation context. An authenticated user capable of starting migrations can point ...

CVE-2026-60021 Gitea GitLab migration denial of service

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request...

CVE-2026-60021 Gitea GitLab migration denial of service

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request...

CVE-2026-60021

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request...

PT-2026-114182

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.79.0 Description An issue exists where users can trigger server-side request forgery, a flaw that allows a server to be coerced into making requests to an unintended location. This occurs when the shared HTTP clie...

PT-2026-114233

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The initial GitLab migration version probe utilizes an HTTP client that lacks a timeout and fails to attach the migration task's cancellation context. An authenticated user capable of initiatin...

CVE-2026-101899

The Axios HTTP client (versions 1.15.0 through 1.20.0 ) contains a vulnerability where the shouldBypassProxy function incorrectly treats NO_PROXY CIDR entries as textual hostname suffixes instead of evaluating the network range. This causes requests targeting addresses covered by CIDR bypass rule...

CVE-2026-109245

A flaw was found in FreeRDP. This vulnerability leads to information disclosure because the internal HTTP client fails to verify Transport Layer Security TLS server certificates or hostnames. An on-path network attacker positioned between the client and identity provider can exploit this flaw by...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.5), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +93 more potentially affected by CVE-2026-107226 via org.asynchttpclient:async-http-client (>=3.0.0, <=3.0.13)

org.asynchttpclient:async-http-client MAVEN version =3.0.0, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =2.0.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =0.0.11 and more Source cves: CVE-2026-107226 Source advisory: MEND:CVE-2026-107226...

Amazon Linux 2 : php (ALASPHP8.2-2026-014)

The version of php installed on the remote host is prior to 8.2.34-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2026-014 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough...

Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-3163)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3163 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2026-3161)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3161 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a...