Lucene search
+L

3974 matches found

CVE
CVE
added 2026/09/10 9:01 p.m.26 views

CVE-2026-45759

Suricata (a network IDS/IPS/NMS engine) is vulnerable to a denial of service via quadratic processing of large HTTP Content-Disposition headers during HTTP response body processing. Prior to versions 7.0.16 and 8.0.5 , crafted HTTP traffic can cause excessive CPU consumption with no impact on con...

7.5CVSS5.7AI score0.00585EPSS
SaveExploits0References3Affected Software1
NVD
NVD
added 2026/09/08 8:18 p.m.6 views

CVE-2026-78560

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...

6.5CVSS0.00201EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/08 8:09 p.m.28 views

CVE-2026-78560 Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...

4.8CVSS0.00201EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/08 8:09 p.m.6 views

CVE-2026-78560 Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...

4.8CVSS5.9AI score0.00201EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/08 8:09 p.m.7 views

EUVD-2026-74171

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...

4.8CVSS5.9AI score0.00201EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 2026/09/08 12:00 a.m.9 views

NewStart CGSL MAIN 7.02 : busybox Multiple Vulnerabilities (NS-SA-2026-0087)

The remote NewStart CGSL host, running version MAIN 7.02, has busybox packages installed that are affected by multiple vulnerabilities: - BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal...

8.8CVSS7.2AI score0.03492EPSS
SaveExploits3References9
Positive Technologies
Positive Technologies
added 2026/09/08 12:00 a.m.11 views

PT-2026-88429

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...

4.8CVSS5.9AI score0.00201EPSS
SaveExploits0References2
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/07 10:11 p.m.15 views

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-0865 DESCRIPTION: User-controlled header names and values containing newlines can allow injecting HTTP headers. CWE:CWE-74: Improper Neutralization of...

9.8CVSS6.7AI score0.01315EPSS
SaveExploits4Affected Software1
OSV
OSV
added 2026/09/03 7:19 a.m.6 views

SUSE-SU-2026:3930-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: - CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response...

9.8CVSS6.6AI score0.03711EPSS
SaveExploits4References72
OSV
OSV
added 2026/09/03 7:18 a.m.4 views

SUSE-SU-2026:3929-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: - CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response...

9.8CVSS6.8AI score0.03711EPSS
SaveExploits4References72
SUSE Linux
SUSE Linux
added 2026/09/03 7:18 a.m.13 views

Security update for nodejs20

This update for nodejs20 fixes the following issues: CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery...

8.7CVSS6.9AI score0.03711EPSS
SaveExploits4References142
NVD
NVD
added 2026/09/02 3:17 p.m.13 views

CVE-2026-2811

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

5.4CVSS0.00165EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/02 2:25 p.m.18 views

CVE-2026-2811

The Ajaxify Comments WordPress plugin before version 3.2 is affected by an HTTP Header Injection vulnerability caused by insufficient input sanitization and output escaping on user-supplied data. Unauthenticated attackers can inject arbitrary HTTP headers, resulting in low confidentiality and int...

5.4CVSS6AI score0.00165EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/02 2:25 p.m.16 views

CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

5.4CVSS6AI score0.00165EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/02 2:25 p.m.12 views

EUVD-2026-70050

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

5.4CVSS6AI score0.00165EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/02 2:25 p.m.35 views

CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

5.4CVSS0.00165EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/09/02 12:00 a.m.17 views

PT-2026-84723

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

5.4CVSS6AI score0.00165EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/09/01 12:00 a.m.12 views

PT-2026-84257

httpd has never implemented obs-fold RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue...

8.3CVSS5.9AI score0.00328EPSS
SaveExploits0References7
FreeBSD
FreeBSD
added 2026/09/01 12:00 a.m.16 views

Erlang/OTP -- multiple vulnerabilities in inets, stdlib, snmp and eldap

The Erlang/OTP project reports: OTP 29.0.6, 28.5.0.6 and 27.3.4.17 fix the following issues, most of them in the inets httpd and httpc implementations: CVE-2026-55951: httpc Memory Exhaustion via Unbounded Header Accumulation. CVE-2026-59696: stdlib: Denial-of-Service enabled by Unbounded Integer...

8.7CVSS5.9AI score0.00702EPSS
SaveExploits0References15
RedhatCVE
RedhatCVE
added 2026/08/31 2:20 p.m.11 views

CVE-2026-19880

A flaw was found in Logback-classic. This path-traversal vulnerability allows a remote attacker to create and append log files outside the intended directory. This occurs because an unsanitized discriminator value, influenced by the attacker for example, via an HTTP header, is used in a file path...

6.5CVSS5.9AI score0.00331EPSS
SaveExploits0References4
Rows per page
Query Builder