EulerOS 2.0 SP15 : nghttp2 (EulerOS-SA-2026-3994)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

Linux Distros Unpatched Vulnerability : CVE-2026-107228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the...

EulerOS 2.0 SP15 : perl-HTTP-Tiny (EulerOS-SA-2026-4004)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.x000D x000D When the server returns ...

EulerOS 2.0 SP15 : nghttp2 (EulerOS-SA-2026-3928)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

openSUSE 16 Security Update : prometheus-blackbox_exporter (openSUSE-SU-2026:22026-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22026-1 advisory. Changes in prometheus-blackboxexporter: - CVE-2026-84304: Fix heap memory exhaustion OOM via HTTP/2 DATA frame fragmentation in gRPC-Go by bumpi...

EulerOS 2.0 SP15 : perl-HTTP-Tiny (EulerOS-SA-2026-3938)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.x000D x000D When the server returns ...

CVE-2026-97032: Concurrent Execution using Shared Resource with Improper Synchronization

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

PT-2026-134956

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

PT-2026-107774

An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated remot...

PT-2026-108699

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS INITIAL WINDOW SIZE values...

PT-2026-108701

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

PT-2026-108700

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CVE-2026-107718: URL Redirection to Untrusted Site

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL helper used by Router.makeUrl and Response.redirect.toRoute. If an...

CVE-2026-107399: Exposure of Sensitive Information to an Unauthorized Actor

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

CVE-2026-85487: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...

CVE-2026-105673: Stack-based Buffer Overflow

An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corruption and crash the streaming daemon. Successful...

PT-2026-108715

Name of the Vulnerable Software and Affected Versions praisonai version 4.6.63 Description The MCP HTTP-stream server fails to enforce authentication by default because the --api-key CLI argument defaults to None. This allows unauthenticated requests to the /mcp endpoint, enabling attackers to...

EulerOS 2.0 SP15 : mod_http2 (EulerOS-SA-2026-3926)

According to the versions of the modhttp2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

CVE-2026-78669: Asymmetric Resource Consumption (Amplification)

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CVE-2026-94439: Inconsistent Interpretation of HTTP Requests

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...