CVE-2026-66062: Inefficient Regular Expression Complexity

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling for headers such as Accept uses a regular expression vulnerable to quadratic backtracking, so a maliciously...

CVE-2026-54199: Improper Input Validation

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality //ServerClientcelink.htm, which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to...

CVE-2026-54214: URL Redirection to Untrusted Site

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded...

CVE-2026-52880: Uncontrolled Resource Consumption

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...

PT-2026-76578

Name of the Vulnerable Software and Affected Versions Libevent versions prior to 2.1.13 Libevent versions prior to 2.2.2-alpha Description An unauthenticated remote attacker can exploit the way chunked HTTP trailers are processed in http.c through the evhttp read trailer function. The software...

PT-2026-68895

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description Tobit Laboratories AG TeamDavid's Webbox contains a flaw in its link storing functionality at the endpoint '//ServerClient celink.htm'. The application fails to properly sanitize the request...

Node.js Module axios 1.15.2 < 1.18.0 Prototype Pollution (CVE-2026-67314)

The version of the axios Node.js module installed on the remote host is 1.15.2 prior to 1.18.0. It is, therefore, affected by a vulnerability: - Prototype-pollution read-side gadgets in Basic auth subfield handling. When an application is already affected by a separate prototype-pollution primiti...

SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:3521-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3521-1 advisory. Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF an...

SUSE CVE-2026-71267

microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy...

DEBIAN-CVE-2026-71554

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

CVE-2026-71554

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

CVE-2026-49391

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

CVE-2026-47194

Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token...

h2: Duplicate Host header could facilitate request smuggling

Impact h2 =4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive CWE-444...

GHSA-6HR6-W5QG-QMWG h2: Duplicate Host header could facilitate request smuggling

Impact h2 =4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive CWE-444...

CVE-2026-71555

PILSOS (the PILOS frontend for BigBlueButton) is affected from version 2.1.0 through 4.14.1 by missing Cross-Origin-Opener-Policy headers, allowing reverse tabnabbing via links that open new browsing contexts (target="_blank"). A malicious destination page could access window.opener to navigate o...

CVE-2026-71554 h2: Duplicate Host header could facilitate request smuggling

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

CVE-2026-71554

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

CVE-2026-71554

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

CVE-2026-71554 h2: Duplicate Host header could facilitate request smuggling

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...