CVE-2026-7192: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

CVE-2026-102878: Origin Validation Error

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

RHCOS 4 : Red Hat build of MicroShift 4.22.16 (RHSA-2026:71672)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71672 advisory. - encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 - net/http: golang...

Amazon Linux 2 : squid (ALAS-2026-3961)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3961 advisory. Due to a CWE-841 Improper Enforcement of Behavioral Workflowbug Squid is vulnerable to a Request Smuggling attack againstHTTP/1.1...

PT-2026-108423

Security vulnerability affects the kafka package. A client may issue specially crafted HTTP/1...

Important: squid

Issue Overview: Due to a CWE-841 Improper Enforcement of Behavioral Workflow bug Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used. Bypassing security...

Amazon Linux 2023 : squid (ALAS2023-2026-3145)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3145 advisory. Due to a CWE-841 Improper Enforcement of Behavioral Workflowbug Squid is vulnerable to a Request Smuggling attack againstHTTP/1.1 Transfer-Encoding. This problem allows a trusted client to perform an...

PT-2026-108471

Security vulnerability affects the argo-workflows package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS MAX FRAME SIZE with a value of 0...

PT-2026-102521

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/do cmd.js’ endpoint containing an excessively long...

PT-2026-102722

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the...

PT-2026-108588

Security vulnerability affects the sonarqube package. A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS...

PT-2026-102719

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport socket options while selecting an HTTP/3 connection pool without first checking whether t...

PT-2026-108375

Security vulnerability affects the elasticsearch package. In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials...

PT-2026-108592

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

PT-2026-108547

Security vulnerability affects the apache-superset package. A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node...

PT-2026-108501

Security vulnerability affects the kafka package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...

PT-2026-108433

Security vulnerability affects the argo-workflows package. Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP...

PT-2026-108515

Security vulnerability affects the sonarqube package. Uncontrolled Resource Consumption vulnerability in the HTTP/1...

PT-2026-108378

Security vulnerability affects the argo-workflows package. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines...

PT-2026-102726

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete...