SUSE-SU-2026:3930-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: - CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response...

Security update for nodejs20

This update for nodejs20 fixes the following issues: CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery...

SUSE-SU-2026:3929-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: - CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response...

CVE-2026-2811

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

EUVD-2026-70050

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

CVE-2026-2811

The Ajaxify Comments WordPress plugin before version 3.2 is affected by an HTTP Header Injection vulnerability caused by insufficient input sanitization and output escaping on user-supplied data. Unauthenticated attackers can inject arbitrary HTTP headers, resulting in low confidentiality and int...

HTTP Header Injection

Blaze is vulnerable to HTTP header injection. The vulnerability is due to blaze-server merging attacker-controlled HTTP trailer fields into Request.headers, which allows an unauthenticated remote attacker to inject or spoof trusted headers such as X-Forwarded-For, X-Real-IP, X-Forwarded-Host, or...

CVE-2026-2811: Improper Neutralization of CRLF Sequences in HTTP Headers

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

PT-2026-84723

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

Erlang/OTP -- multiple vulnerabilities in inets, stdlib, snmp and eldap

The Erlang/OTP project reports: OTP 29.0.6, 28.5.0.6 and 27.3.4.17 fix the following issues, most of them in the inets httpd and httpc implementations: CVE-2026-55951: httpc Memory Exhaustion via Unbounded Header Accumulation. CVE-2026-59696: stdlib: Denial-of-Service enabled by Unbounded Integer...

PT-2026-84257

Name of the Vulnerable Software and Affected Versions OTP versions 17.0 through 27.3.4.16 OTP versions 28.0 through 28.5.0.5 OTP versions 29.0 through 29.0.5 inets versions 5.10 through 9.3.2.6 inets versions 9.4 through 9.6.2.2 inets versions 9.7 through 9.7.1 Description httpd does not implemen...

CVE-2026-19880

A flaw was found in Logback-classic. This path-traversal vulnerability allows a remote attacker to create and append log files outside the intended directory. This occurs because an unsanitized discriminator value, influenced by the attacker for example, via an HTTP header, is used in a file path...

CVE-2026-59314 Spring Framework response splitting in ContentDisposition

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...

CVE-2026-59314 Spring Framework response splitting in ContentDisposition

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...

CVE-2026-59314

Spring Framework spring-web is vulnerable to HTTP response splitting when untrusted input is used to build a Content-Disposition header value. An attacker can inject malicious characters via specially crafted file names to break HTTP headers or corrupt the framing of an outbound multipart body. T...

EUVD-2026-67184

Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

CVE-2026-59298 Potential for improper filtering of HTTP headers in Spring Cloud Function

Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by an uncontrolled resource consumption vulnerability due to Apache HttpComponents Core

Summary Apache HttpComponents Core is used by IBM Integrated Analytics System as a Java library providing low-level HTTP transport components. CVE-2026-54399 affects the HTTP/1.1 message parser in Apache HttpComponents Core versions 5.4.2 and earlier, where insufficient limits on the number and...