CVE-2026-105245 sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function serverinfo of the file python/sglang/srt/entrypoints/httpserver.py of the component HTTP Endpoint. Such manipulation of the argument apikey leads to cleartext transmission of sensitive information. ...

EUVD-2026-92264

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function serverinfo of the file python/sglang/srt/entrypoints/httpserver.py of the component HTTP Endpoint. Such manipulation of the argument apikey leads to cleartext transmission of sensitive information. ...

CVE-2026-105245 sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function serverinfo of the file python/sglang/srt/entrypoints/httpserver.py of the component HTTP Endpoint. Such manipulation of the argument apikey leads to cleartext transmission of sensitive information. ...

Important: Red Hat Security Advisory: mod_auth_openidc security update

An update for modauthopenidc is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing

A flaw was found in modauthopenidc, an OpenID Connect Relying Party module for Apache HTTP servers. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with a malformed state cookie. This can lead to an out-of-bounds read and a one-byte out-of-bounds write...

rapidresetclient

Rapid Reset Client Rapid Reset Client è uno strumento per testare le mitigazioni e l'esposizione a CVE-2023-44487 vettore di attacco DDoS Rapid Reset. Implementa un client HTTP/2 minimale che apre un singolo socket TCP, negozia TLS, ignora il certificato e scambia frame SETTINGS. Il client invia...

Malicious code in aria-live-region-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 391a9a163273e36e3945f918ea720b8e10aa462b0aa603d4012b28c557c58570 The package is advertised as an ARIA accessibility helper but ships thunderboltRegistry.js, which executes a top-level IIFE on module load. The IIFE...

MAL-2026-17557 Malicious code in css-svqggc-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b23cf39720388bcf9f26621bd52e256e18a011bf3b6821b7d9f5f60115b9663 Package masquerades as a CSS polyfill while impersonating internal Wix Thunderbolt registry modules thunderboltRegistry, siteAssetsRegistry,...

CVE-2026-95265

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

CVE-2026-86671: Server-Side Request Forgery (SSRF)

In Eclipse Che versions 7.29.0 and later, the GET /api/scm/resolve and POST /api/factory/resolver endpoints pass an attacker-controlled URL to URLFetcher.fetch, which calls new URLurl.openConnection with no scheme or host allow-list and returns the response body to the caller. Any authenticated C...

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path /capacitorhttpinterceptor is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading th...

CVE-2026-105245: Cleartext Transmission of Sensitive Information

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function serverinfo of the file python/sglang/srt/entrypoints/httpserver.py of the component HTTP Endpoint. Such manipulation of the argument apikey leads to cleartext transmission of sensitive information. ...

PT-2026-106226

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

PT-2026-104736

Name of the Vulnerable Software and Affected Versions sgl-project sglang versions prior to 0.5.22 Description A flaw in the HTTP Endpoint component allows remote attackers to cause the cleartext transmission of sensitive information. This occurs through the manipulation of the api key argument...

CVE-2026-104956: Improper Neutralization of Special Elements in Data Query Logic

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-95265: Server-Side Request Forgery (SSRF)

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

Debian dla-4821 : libperl-dev - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4821 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4821-1 [email protected]...

PT-2026-105987

Name of the Vulnerable Software and Affected Versions Progress Telerik Fiddler Classic for Windows versions prior to 6.0.20262.10021 Description HTTP request smuggling is possible in the proxy request forwarding component. This occurs when requests containing multiple Content-Length headers with...

Cisco ASA Uncontrolled Resource Consumption (CVE-2019-12698)

A vulnerability in the WebVPN feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause increased CPU utilization on an affected device. The vulnerability is due to excessive processing load f...

RHEL 10 : mod_auth_openidc (RHSA-2026:75581)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:75581 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID...