CVE-2026-11710: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

CVE-2026-11722: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability...

Cisco Identity Services Engine (cisco-sa-ise-multi-hrP9jQSQ)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web...

EulerOS Virtualization 2.12.0 : nghttp2 (EulerOS-SA-2026-3655)

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body ont...

CVE-2026-10841: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling...

CVE-2026-93573: Inconsistent Interpretation of HTTP Requests

A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass Transfer-Encoding header validation by splitting the Transfer-Encoding field across multiple headers, with the last field containing a non-final transfer coding like gzip or deflate. This bypass ca...

CVE-2026-93562: Undefined Security Weakness

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...

Oracle Linux 8 : libevent (ELSA-2026-67908)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-67908 advisory. - Fix CVE-2026-63385: HTTP header injection via CRLF in header values - Fix CVE-2026-63387: out-of-bounds write in evdns dnsnametolabels - Fix...

EulerOS 2.0 SP15 : libsoup (EulerOS-SA-2026-3785)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soupbodyinputstreamreadchunked functio...

PT-2026-95401

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description An issue exists where strict validation of the chunk-size line is skipped when the line contains no chunk extension ;. A remote attacker can exploit this by sending a specially crafted HTTP...

CVE-2026-93574: Inconsistent Interpretation of HTTP Requests

A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...

CVE-2026-93566: Undefined Security Weakness

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...

Cisco Identity Services Engine (cisco-sa-ise-rce-se7bYU57)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must...

The vulnerability of the formTracert() function in Tenda HG3 software allows a hacker to execute arbitrary code.

The vulnerability of the formTracert function in Tenda HG3 router microprogramming software is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code by sending a specially crafted HTTP request...

EUVD-2026-82415

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOXDTLIBRARYURL in tests/testconfiguration.py is a free-form tracked constant that an unauthenticated pull-request author can change before the...

Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension

A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP...

Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension

A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP...

Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension

A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP...

Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension

A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP...

CVE-2026-85078

A flaw was found in Sanic, an open-source Python web server/framework. A remote, unauthenticated attacker can exploit incomplete handling of HTTP/1.1 chunked-body requests. By injecting malicious data into the request's trailer section, the attacker can cause Sanic to process a hidden second...