17200 matches found
CVE-2024-7708
A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause a denial of service DoS by sending specially crafted HTTP requests. Specifically, a buffer leak occurs when processing requests that have a body but read zero bytes, such as 100-Continue requests, or during sl...
EUVD-2026-62275
The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back...
CVE-2026-17565
The Animation Addons for Elementor WordPress plugin before 2.7.2 is vulnerable to unauthenticated Server-Side Request Forgery (SSRF). An attacker supplies a value used to build the host of a server-side HTTP request, enabling the site to issue requests to internal hosts and return responses. CVSS...
CentOS 9 : nghttp2-1.43.0-8.el9
The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the nghttp2-1.43.0-8.el9 build changelog. - nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...
MiracleLinux 8 : nghttp2-1.33.0-6.el8_10.3 (AXSA:2026-1576:03)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1576:03 advisory. nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 Tenable has extracted t...
ROS-20260819-73-0068
The vulnerability of the nghttpx component in the nghttp2 library is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...
CVE-2026-65985
In FUXA versions 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js lets an authenticated non-admin runtime user control property.address, turning the server into a read SSRF oracle against internal services or cloud metadata endpoints. Exploitation is not r...
CVE-2026-75897 Uncontrolled Resource Consumption in Capabilities Route in OpenSearch Dashboards
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request...
EUVD-2026-61064
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request...
CVE-2026-50576 ePA 3.x Integration: HTTP Header Injection in VAU Inner Requests
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The...
USN-8641-1: .NET vulnerabilities
Miha Zupan discovered that .NET did not properly interpret certain HTTP requests. An attacker could possibly use this issue to perform request smuggling and bypass a security feature. CVE-2026-62899 Ivan Demchuk discovered that .NET did not properly handle the removal of sensitive information...
Security Bulletin: IBM Guardium Data Protection is affected by a Denial-of-Service (DoS) vulnerability in Micrometer (CVE-2026-40984)
Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-40984 DESCRIPTION: In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Affected versions:...
CVE-2021-43718
An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a Denial of Service via specially crafted series of HTTP...
GLSA-202608-16 : nginx: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202608-16 nginx: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly from...
.NET: .NET Core: .NET Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...
.NET: .NET Core: .NET Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...
GHSA-6364-X4QJ-7W59 vulnerabilities
Vulnerabilities for packages: nginx-mainline, nginx-stable...
GHSA-FM65-XRRR-C358 vulnerabilities
Vulnerabilities for packages: nginx-mainline, nginx-stable...