147272 matches found
CVE-2026-76083: Server-Side Request Forgery (SSRF)
Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/queryrunner/jsonds.py used getallresults to combine its configured baseurl with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured...
PT-2026-113740
Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A remote HTTP server can set a cookie that is accepted and written to a Netscape cookie jar but cannot be reloaded. When curl is subsequently invoked using the same path for the --cookie and...
PT-2026-114313
Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An issue exists during the HSTS cache import process where importing a parent HSTS entry with the includeSubDomains flag before a longer-lived child entry causes the child entry to be silently...
PT-2026-113742
Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An HTTP proxy can trick libcurl into sending the origin's credentials, such as Basic passwords or Negotiate/Kerberos tickets, directly to the proxy. This occurs when the proxy responds to a...
PT-2026-114013
The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...
CVE-2026-92392: Use After Free
During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...
PT-2026-122878
TuxCare rebuilt http-proxy-middleware to address 2 CVEs. Fixed in 4.0.0-tuxcare.1...
PT-2026-122310
Security vulnerability affects the solr package. A client may issue specially crafted HTTP/1...
PT-2026-114149
Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description An HTTP header injection issue exists in the proxy component. This occurs because a lone Line Feed LF character within the target portion of a routing token, specifically in the Cookie: msts=...
PT-2026-113982
Name of the Vulnerable Software and Affected Versions bandit versions 1.4.0 and later Description Uncontrolled resource consumption allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely. By sending a trickle of small WINDOW UPDATE frames or empty SETTINGS frames, a...
RHEL 10 : libsoup3 (RHSA-2026:82728)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:82728 advisory. Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the...
Linux Distros Unpatched Vulnerability : CVE-2026-93582
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either the REMOTEUSER or HTTPREMOTEUSER...
Unity Linux 20.1070a Security Update: grafana-pcp (UTSA-2026-130122)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130122 advisory. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...
PT-2026-122290
Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Lightweight HTTP Server...
PT-2026-114355
Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A flaw exists in the ngx http v3 module module. When HTTP/3 is used in conjunction with the proxy request buffering directive set to on, a...
Quarkus Java Framework Data Compromise
The vulnerability of the Quarkus framework is related to incorrect interpretation of HTTP requests. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of the protected information...
mpfddecode function in the Data Compromise
The vulnerability of the mpfddecode function in the bootloaderregion.bin file of the Emergency HTTP Recovery Server component of the D-Link DCS-930L Wi-Fi camera software is related to insufficient data authentication checks. Exploiting this vulnerability could allow an attacker to compromise the...
CVE-2026-105659: Uncontrolled Resource Consumption
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...
CVE-2026-92392: Use After Free
During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...