EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2755)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...

EulerOS Virtualization 2.12.0 : python3 (EulerOS-SA-2026-2795)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : User-controlled header names and values containing newlines can allow injecting HTTP headers.CVE-2026-0865 Tenable has extracted t...

EulerOS Virtualization 2.12.0 : python-urllib3 (EulerOS-SA-2026-2801)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level...

CVE-2025-66390

Microsoft Azure API Management (prior to 2025-10-17) contains a vulnerability where the underlying signup API endpoint remains active even if self-service registration is disabled via the portal UI. When Basic Authentication is enabled, an attacker can perform a cross-tenant signup bypass by reus...

CVE-2025-66390: Improper Access Control

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...

CVE-2025-66390

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...

CVE-2025-66390

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...

KLA91170 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Denia...

CVE-2026-57209

When Heimdall operates in proxy mode, it constructs the "Forwarded" HTTP header after executing the matched rule pipeline by inserting the incoming request's "Host" header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional...

CVE-2026-57210

When the "trustedproxies" option is configured, heimdall extracts client IP addresses from the "Forwarded" "for=" parameter and "X-Forwarded-For" headers and exposes them as "Request.ClientIPAddresses" to the rule pipeline. However, extracted values are not validated to be syntactically valid IP...

Guzzle: URI fragments disclosed in redirect Referer headers

Impact When the optional referer redirect setting is enabled, affected versions of RedirectMiddleware can copy the fragment from the referring request URI into a generated Referer header. A URI fragment is the part after . It is handled locally by the client and is not part of the HTTP request...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the RedirectMiddleware process. An attacker can access sensitive information included in URI fragments by controlling the redirect destination and inspecting the...

Guzzle: Unbounded response cookies risk denial of service

Impact In affected versions, Guzzle's built-in CookieJar accepts any number of Set-Cookie header fields from one response, with no limit on the size of each field. When a later request matches the stored cookies, Guzzle places every match into one generated Cookie header without limiting the numb...

CVE-2026-55833 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833

Netty (network application framework) contains a vulnerability in SPDY header decoding. Prior to versions 4.1.136.Final and 4.2.16.Final, the zlib-compressed header blocks may continue inflating after the header parser exceeds maxHeaderSize, allowing a remote peer to send a small compressed HEADE...

CVE-2026-55833 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution n the getMergedValue function of lib/core/mergeConfig.js, which clones nested option objects such as auth and paramsSerializer into plain containers...