46206 matches found
CVE-2026-1502
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
CVE-2026-1502
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
UBUNTU-CVE-2026-1502
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
CVE-2026-1502
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
CVE-2026-1502
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
CVE-2026-1502 HTTP client proxy tunnel headers not validated for CR/LF
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
CVE-2026-1502 HTTP client proxy tunnel headers not validated for CR/LF
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
CVE-2026-1502
The CVE-2026-1502 entry concerns CR/LF bytes not being rejected by HTTP client proxy tunnel headers or host, as described in both the CVE record and the CVE-List entry. The connected documents indicate this is related to HTTP client proxy tunnel header validation, without providing specific affec...
PSF-2026-15
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
CRLF Injection
Overview Affected versions of this package are vulnerable to CRLF Injection via improper validation of HTTP client proxy tunnel headers or host fields. An attacker can inject arbitrary HTTP headers. Remediation A fix was pushed into the master branch but not yet published. References - GitHub...
CVE-2026-40160
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, webcrawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get with followredirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints...
CVE-2026-35650
OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through inconsistent sanitization paths. Attackers can supply blocked or malformed override keys that slip through inconsistent validation ...
Improper Validation of Certificate with Host Mismatch
Overview org.apache.logging.log4j:log4j-core is a logging library for Java. Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to the lack of TLS hostname verification in the SocketAppender component when configured through the...
CVE-2026-40160
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, webcrawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get with followredirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints...
CVE-2026-40159 PraisonAI Exposes Sensitive Environment Variable via Untrusted MCP Subprocess Execution
PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI’s MCP Model Context Protocol integration allows spawning background servers via stdio using user-supplied command strings e.g., MCP"npx -y @smithery/cli ...". These commands are executed through Python’s subprocess module. By...
CVE-2026-40159
PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI’s MCP Model Context Protocol integration allows spawning background servers via stdio using user-supplied command strings e.g., MCP"npx -y @smithery/cli ...". These commands are executed through Python’s subprocess module. By...
CVE-2026-40226
In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file...
AZL-82646 CVE-2026-40226 affecting package systemd for versions less than 255-30
In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file...