HarfBuzz buffer error vulnerability

The HarfBuzz version 8.0.0 to 14.6.0 contains a buffer error vulnerability. This vulnerability stems from an error in the WAMR signature imported by fontglyphtostring in the experimental WebAssembly shaper. An attacker can provide a specially crafted font, and their wasm module will place the...

Curl encryption vulnerability

The curl version 7.81.0 to 8.22.0 has an encryption-related vulnerability. This vulnerability stems from logical flaws in the curl command-line tool. As a result, the SSH host authentication option is only set when using direct SFTP or SCP interactions. However, it is not set during redirection,...

Eclipse OpenJ9 input validation error vulnerability

Eclipse OpenJ9 versions 0.63 and earlier contain a security vulnerability. This vulnerability arises when the jdmpview tool or equivalent DTFJ code is used to open a specially crafted diagnostic dump package; it may then read any local file specified within the package and send its contents to an...

Curl encryption vulnerability

The curl version 8.22.0 and earlier have an encryption-related vulnerability. This vulnerability arises when libcurl uses libssh2 to process the hash of the knownhosts file. In this case, unrelated initial entries can cause host key verification to falsely report a key mismatch as a key absence...

curl resource management error vulnerability

The curl version 7.56.0 to 8.22.0 contains a resource management vulnerability. This vulnerability arises from constructing deeply nested multipart MIME structures using public APIs, leading to a libcurl stack overflow during normal cleanup operations. Additionally, the recursive depth of...

Fastify fast-uri input validation vulnerability

The Fastify fast-uri versions from 2.4.2 to 2.4.7, 3.1.3 to 3.1.8, and 4.0.1 to 4.2.2 have security vulnerabilities. These vulnerabilities stem from the canonicalizeHost function, which does not check whether the WHATWG URL parser treats the entire input as a host for host name consumption. As a...

Cloudflare Pingora security vulnerabilities

Cloudflare Pingora versions 0.1.0 to 0.9.0 contain security vulnerabilities. These vulnerabilities arise from failing to compare the Host header of HTTP/2 requests with the :authority pseudoheader. Additionally, the authority containing userinfo is not rejected, resulting in requests that are...

Insufficient Granularity of Access Control

Overview Affected versions of this package are vulnerable to Insufficient Granularity of Access Control via the isHttpProxy function in the Platform HTTP component. When a deployment exposes a route whose configured path begins with proxy such as proxyStats, the endpoint acts as a catch-all...

curl: urlapi: CURLUPART_HOST accepts text after an IPv6 zone ip and URL round trip changes the host

Summary: six or fewer sentences describing the issue in your own human voice and optionally a short proof-of-concept script An app can set a host from untrusted input from CURLUPARTHOST, as the docs allow, and rely on curl to reject bad hosts. curl accepts fe80::1%[email protected]/x as a valid...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the KnativeHttpConsumer in the camel-knative HTTP consumer. An external sender can trigger a consumer-side route failure by sending a request that causes exchange processing to fail, then read the exception clas...

MSC-2026-12954

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-12951

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-12950

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-12952

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-12956

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-12955

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-12957

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-12953

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

CVE-2026-85251 Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than...

CVE-2026-85251 Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than...