apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities

A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory path traversal, and improper neutralization of CRLF sequences in HTTP headers HTTP request/response splitting. A remote attacker could exploit...

apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities

A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory path traversal, and improper neutralization of CRLF sequences in HTTP headers HTTP request/response splitting. A remote attacker could exploit...

CVE-2026-69243

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities

A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory path traversal, and improper neutralization of CRLF sequences in HTTP headers HTTP request/response splitting. A remote attacker could exploit...

CVE-2026-73145

A flaw was found in svxlink's asynchronous HTTP server. No limits are enforced on incoming HTTP request-line or header sizes. A remote attacker can send excessively large requests to exhaust available memory, resulting in a denial of service. Mitigation Update svxlink to version 26.05.1 or later...

Security Bulletin: IBM Transformation Extender Advanced is affected by a IBM WebSphere Application Server Liberty vulnerability

Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine, is vulnerable to IBM WebSphere Application Server Liberty's HTTP request smuggling vulnerability CVE-2026-11541 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes sectio...

Fedora 43 : nghttp2 (2026-91dd0c29d6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-91dd0c29d6 advisory. - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 Tenable has extracted the preceding...

CVE-2026-20349: Improper Clearing of Heap Memory Before Release

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of servic...

VulnCheck KEV: CVE-2026-20349

Cisco Secure Firewall Adaptive Security Appliance ASA and Secure Firewall Threat Defense FTD contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service DoS condition...

PT-2026-70127

Name of the Vulnerable Software and Affected Versions Dub versions prior to 2026-07-10 Description An unauthenticated remote attacker can induce the server to issue HTTP requests to arbitrary internal or external hosts. This occurs via the 'metatags edge' endpoint, which fetches any caller-suppli...

PT-2026-70176

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution...

CVE-2026-72774: Authorization Bypass Through User-Controlled Key

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution...

CVE-2026-62899: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-70591

Name of the Vulnerable Software and Affected Versions .NET affected versions not specified Description Inconsistent interpretation of HTTP requests, known as HTTP request/response smuggling, allows an unauthorized attacker to bypass security features over a network. HTTP request smuggling occurs...

PT-2026-70241

Name of the Vulnerable Software and Affected Versions Undertow HTTP server affected versions not specified WildFly affected versions not specified JBoss EAP affected versions not specified Description A flaw exists in the ChunkReader component of the Undertow HTTP server, which is utilized by...

CVE-2026-14180: Inconsistent Interpretation of HTTP Requests

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

Fedora 44 : python-webob (2026-7aaa63dd24)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7aaa63dd24 advisory. Update to upstream - CVE-2024-42353. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has n...

CVE-2026-72916

Mastodon CVE-2026-72916 affects PrivateAddressCheck.private_address? in app/lib/private_address_check.rb, which incorrectly normalized IPv4-mapped IPv6 addresses and did not recognize IPv4-compatible IPv6 addresses with IPAddr#ipv4_compat?. This allowed an attacker to bypass ALLOWED_PRIVATE_ADDRE...

CVE-2026-72591 Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

CVE-2026-72566 automatisch - Server-Side Request Forgery via HTTP Request Custom Action

A server-side request forgery SSRF vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action...