EUVD-2026-92107

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register...

CVE-2026-105214: Server-Side Request Forgery (SSRF)

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register...

Debian dla-4819 : libapache2-mod-php8.2 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4819 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4819-1 [email protected]...

PT-2026-104638

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register...

CVE-2026-105216: Improper Certificate Validation

go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC...

caddy v2.11.7

a project Every site on HTTPS Caddy is an extensible server platform that uses TLS by default. Releases · Documentation · Get Help Powered by Special thanks to: Warp, built for coding with multiple AI agents Available for MacOS, Linux, & Windows Menu Features Install Build from source For...

web-vulnerability-scanner

vulnerabilityscanner VulnRadar – An intera...

Security Bulletin: Due to the use of HTTP/1.1 with Jetty server, IBM Sterling Control Center is vulnerable to Inconsistent Interpretation of HTTP Requests (CVE-2026-19203)

Summary HTTP/1.1 with Jetty server is used by IBM Sterling Control Center as part of dependency in jetty-http-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-19203 DESCRIPTION: A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary...

Security Bulletin: Due to the use of HTTP/2 requests to a Jetty server, IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-12611)

Summary HTTP/2 requests with Jetty server is used by IBM Sterling Control Center as part of dependency in jetty-http2-common-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-12611 DESCRIPTION: A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never...

[SECURITY] Fedora 45 Update: libsoup-2.74.3-12.fc45

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications...

EUVD-2026-91837

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

[SECURITY] Fedora 45 Update: httpd-2.4.68-7.fc45

The Apache HTTP Server is a powerful, efficient, and extensible web server...

[SECURITY] Fedora 45 Update: erlang-cowboy-2.18.0-2.fc45

Small, fast, modular HTTP server written in Erlang...

NetScaler 73.30 HTTP Request Smuggling

NetScaler version 73.30 contains an HTTP/1.1 chunk-size accumulator overflow that can cause request parsing desynchronization and request smuggling...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

GHSA-CJCG-CXMH-9WCR Praxis affected by HTTP/2 Bomb

Summary Multiple denial-of-service vulnerabilities have been discovered in HTTP/2 server implementations. All have been rated with a severity impact of Important. The vulnerabilities target HPACK, the header compression scheme in HTTP/2, where a small request can trigger large memory allocations ...

Praxis affected by HTTP/2 Bomb

Summary Multiple denial-of-service vulnerabilities have been discovered in HTTP/2 server implementations. All have been rated with a severity impact of Important. The vulnerabilities target HPACK, the header compression scheme in HTTP/2, where a small request can trigger large memory allocations ...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...