Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path /capacitorhttpinterceptor is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading th...

Debian dla-4821 : libperl-dev - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4821 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4821-1 [email protected]...

CVE-2026-105245: Cleartext Transmission of Sensitive Information

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function serverinfo of the file python/sglang/srt/entrypoints/httpserver.py of the component HTTP Endpoint. Such manipulation of the argument apikey leads to cleartext transmission of sensitive information. ...

PT-2026-104736

Name of the Vulnerable Software and Affected Versions sgl-project sglang versions prior to 0.5.22 Description A flaw in the HTTP Endpoint component allows remote attackers to cause the cleartext transmission of sensitive information. This occurs through the manipulation of the api key argument...

ALSA-2026:75581 Important: mod_auth_openidc security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsi...

CVE-2026-95265: Server-Side Request Forgery (SSRF)

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

CVE-2026-104956: Improper Neutralization of Special Elements in Data Query Logic

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

PT-2026-105987

Name of the Vulnerable Software and Affected Versions Progress Telerik Fiddler Classic for Windows versions prior to 6.0.20262.10021 Description HTTP request smuggling is possible in the proxy request forwarding component. This occurs when requests containing multiple Content-Length headers with...

CVE-2026-77802: Inconsistent Interpretation of HTTP Requests

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

PT-2026-106181

Name of the Vulnerable Software and Affected Versions Ghost versions 6.54.1 through 6.64.0 Description A validation issue in the Webmentions functionality allows an unauthenticated user to perform limited HTTP requests to hosts within the internal network of the Ghost server. This type of flaw is...

CVE-2026-105648: Incomplete List of Disallowed Inputs

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

PT-2026-106182

Name of the Vulnerable Software and Affected Versions Ghost versions 6.0.9 through 6.64.0 Description A validation issue in the Webmentions functionality allows an unauthenticated user to perform limited HTTP requests to hosts within the internal network of the Ghost server on certain network...

PT-2026-106271

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.30.0 Description The Rust frontend's track http metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary...

Node.js HTTP Agent Data Compromise

The vulnerability of the Node.js software platform’s HTTP agent is related to synchronization errors when using shared resources. Exploiting this vulnerability allows a remote attacker to compromise the integrity of the protected information...

PT-2026-106226

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

RHEL 10 : mod_auth_openidc (RHSA-2026:75581)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:75581 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID...

Cisco ASA Uncontrolled Resource Consumption (CVE-2019-12698)

A vulnerability in the WebVPN feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause increased CPU utilization on an affected device. The vulnerability is due to excessive processing load f...

Fedora 45 : curl (2026-663a2d0ba4)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-663a2d0ba4 advisory. - fix HTTP/2 server push UAF CVE-2026-18924 - fix Negotiate ambient user conn reuse CVE-2026-19931 - remove test1701 - HTTP/2 Upgrade in a HTTP/1.1...

Cisco ASA Improper Input Validation (CVE-2020-3304)

A vulnerability in the web interface of Cisco Adaptive Security Appliance ASA Software and Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. The vulnerability is...

Malicious code in hardhat-ftp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e916c23a0efbd49d3cfcd5993957df7afbade3f454925d0672acc8c9f68245c The package's declared main entry index.js unconditionally requires./lib/config, a 4,499,968-byte obfuscator.io-packed file 26,234-entry string array...