CLEANSTART-2026-IL95812 urllib3 is an HTTP client library for Python

CVE-2026-97689 affects multiple packages. urllib3 is an HTTP client library for Python. See references for individual vulnerability details...

CLEANSTART-2026-VB00141 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the temporal-server package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

CLEANSTART-2026-KT14793 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

Security vulnerability affects the temporal-server package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

CLEANSTART-2026-XK97843 HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023

Security vulnerability affects the go package. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

CLEANSTART-2026-NX24657 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name

Security vulnerability affects the rundeck package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...

CLEANSTART-2026-QU78029 application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store

Security vulnerability affects the rundeck package. An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store...

EUVD-2026-92873

There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints...

Denial of Service (DoS)

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Denial of Service DoS via the HTTP metrics middleware in rust/src/server/src/middleware/metrics.rs, where arbitrary HTTP method tokens sent by an...

CVE-2026-105759

A flaw was found in vLLM. An unauthenticated remote attacker can cause a denial of service DoS by sending requests with arbitrary, non-standard HTTP method names to unguarded server routes. Because the metrics tracking middleware records raw request methods into monitoring labels without validati...

Brocade Fabric OS authentication and access control bypass via HTTP host header spoofing

: An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual...

PT-2026-107153

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remot...

Security Advisory 0194

Security Advisory 0194 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release Description Two security vulnerabilities have been identified in Arista access point firmware affecting the Captive Portal feature. Both vulnerabilities allow an...

SUSE SLES12: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc (SUSE-SU-2026:4515-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4515-1 advisory. - CVE-2026-60589: improve resource resolving bsc1275777. - CVE-2026-61308: enhance HTTP connections bsc1275778. - CVE-2026-70907:...

Cisco ASA Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-2020-3561)

A vulnerability in the Clientless SSL VPN WebVPN of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to inject arbitrary HTTP headers in the responses of the affected system. The vulnerability is due to...

Rockwell Automation Allen-Bradley Stratix 5950 Improper Input Validation (CVE-2018-0296)

A vulnerability in the web interface of the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. It is also possible on certain software releases that the ASA will...

Cleartext Storage of SupportLink HTTP Proxy Credentials in Diagnostic Support Bundles

: An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support...

PT-2026-107177

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea fails to revalidate destinations when raw Git operations follow HTTP redirects during push mirrors, wiki remote checks, and fetches of migrated pull request heads. A repository...

CVE-2026-102168: Integer Underflow (Wrap or Wraparound)

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remot...

CVE-2026-39724: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in HTTP Requests Manager = 1.3.11 versions...

CVE-2026-105800: Improper Neutralization of Special Elements in Output Used by a Downstream Component

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...