PT-2026-68057

Name of the Vulnerable Software and Affected Versions Layouts for WPBakery versions prior to 1.1.4 Description The plugin is susceptible to unauthorized actions because of a missing capability check in the Layouts WPB Remote::template sync callback, which is registered through wp ajax nopriv hand...

CVE-2026-8182: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP requests...

CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-68981

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-68981: Improper Handling of Highly Compressed Data (Data Amplification)

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

Fedora 43 : coturn (2026-02d5b68472)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-02d5b68472 advisory. Coturn 4.15.0 Security - Ignore STUN attributes after MESSAGE-INTEGRITY GHSA-5538-7cxj-5jcc. Per RFC 8489 9 / RFC 5389 15.4, attributes following...

CVE-2026-24033

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the iss...

CVE-2026-60113: Missing Authentication for Critical Function

AMMOS Instrument Toolkit AIT Deep Space Network DSN Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension SLE interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no...

CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67183: Missing Release of Memory after Effective Lifetime

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

PT-2026-65543

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

Multimodal-web-attack-Dataset — Updated!

MWAD: A Multimodal Web Attack Dataset for AI-Driven SQL Injection Detection Overview The Multimodal Web Attack Dataset MWAD is a novel labelled cybersecurity dataset developed as part of the author's research in cybersecurity at La Trobe University, Australia. The dataset generation methodology,...

CVE-2026-65924: Server-Side Request Forgery (SSRF)

JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery SSRF. An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to issue outbound HTTP requests to arbitrary...

nginx: NGINX: Arbitrary code execution via crafted HTTP requests

A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...

Server-Side Request Forgery (SSRF)

org.apache.camel, camel-dns is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of DNS-related Exchange message headers dns.server, dns.name, dns.domain, etc. that can be passed from inbound HTTP requests, which allows an attacker to manipulate DNS...

EUVD-2026-48306

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDoma...

CVE-2026-12353: Missing Release of Resource after Effective Lifetime

An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary...

CVE-2026-44907

The vulnerability CVE-2026-44907 is a Denial of Service affecting React server-side rendering components. An attacker can trigger high CPU usage by sending specially crafted HTTP requests to server function endpoints in affected packages: react-server-dom-webpack, react-server-dom-parcel, and rea...