PT-2026-84265

Name of the Vulnerable Software and Affected Versions OTP versions 22.2 through 27.3.4.16 OTP versions 28.0 through 28.5.0.5 OTP versions 29.0 through 29.0.5 inets versions 7.1.2 through 9.3.2.6 inets versions 9.4 through 9.6.2.2 inets versions 9.7 through 9.7.1 Description Gracefulness code...

CVE-2026-73812: Inconsistent Interpretation of HTTP Requests

httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...

Security Bulletin: IBM Maximo Application Suite uses IBM WebSphere Application Server Liberty v.26.0.0.6 which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite uses IBM WebSphere Application Server Liberty v.26.0.0.6 which is vulnerable to multiple CVEs. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-5516 DESCRIPTION: IBM WebSphere Application Serv...

CVE-2026-58301

CVE-2026-58301 is a Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro versions 2.x through 3.0.0 , specifically affecting deployments that use the Jakarta EE integration module . A low-privileged user can craft an HTTP request that causes the server to initiate a connection to an a...

ROS-20260831-73-0011

The vulnerability of the HttpObjectDecoder component in the framework for developing network applications, servers, and Netty protocol clients is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected...

The vulnerability of the libyuv component in Google Chrome and Microsoft Edge web browsers allows a hacker to induce a service failure.

The vulnerability of the libyuv component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service outage through a specially created HTML page...

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge web browsers allows attackers to induce a service failure.

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge web browsers allows attackers to induce a service failure.

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge web browsers allows a perpetrator to trigger a service failure.

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

SUSE-SU-2026:23571-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. - CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...

OPENSUSE-SU-2026:21687-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. - CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...

CVE-2026-5096 Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the loadpreviousfieldvalue method in class-evf-form-task.php accepting arbitrary URL values from $POST data for upload fields without domain restriction,...

Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Application Modernization Accelerator. Vulnerability Details CVEID:CVE-2026-9320 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server ...

Security Bulletin: There is a vulnerability in IBM WebSphere Application Server Liberty used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-11806, CVE-2026-11541)

Summary Security Bulletin: There is a vulnerability in IBM WebSphere Application Server Liberty used by IBM Maximo Manage application in IBM Maximo Application Suite Vulnerability Details CVEID:CVE-2026-11806 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is...

PT-2026-83086

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.1 Description Server-side request forgery SSRF exists in the http request and web fetch agent tools. The issue occurs because DNS resolution is performed only during the guard phase without validating the resolutio...

CVE-2026-55758 CC: Tweaked: Incomplete fix for GHSA-5jh9-2h63-pw4q: RFC 8215 NAT64 prefix (64:ff9b:1::/96) bypasses SSRF protection

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the R...

CVE-2026-74848

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...

EUVD-2026-66958

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...

PT-2026-82448

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.12.0 through 3.17.0 Description An inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, occurs on serverless-plugin routes. This allows an attacker to manipulate the request stream so...