5629 matches found
netty-codec-http Arbitrary HTTP Request Injection
The vulnerability of the netty-codec-http module in the framework for developing network applications, servers, and clients using the Netty protocol is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTTP requests...
ROS-20260716-73-0015
The vulnerability of the Google Chrome browser’s Navigation function is related to improper protection of physical external channels. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially created HTML page...
Denial-of-service vulnerability in HTTP/2 servers via stalled flow-control conditions
Overview A denial-of-service DoS vulnerability exists in some HTTP/2 server implementations that fail to adequately limit resource consumption when buffering response data under stalled flow-control conditions. A remote, unauthenticated attacker can trigger memory exhaustion and service...
ROS-20260716-73-0037
The vulnerability of the LocalNetworkAccess function in Google Chrome relates to access control errors. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions through a specially created HTML page...
PT-2026-60452
Name of the Vulnerable Software and Affected Versions HCL DFXServer affected versions not specified Description The application allows users to establish connections over unencrypted channels using the HTTP protocol. This could enable a remote attacker to intercept network traffic and expose...
PT-2026-60605
Name of the Vulnerable Software and Affected Versions h2o versions prior to commit 9265bdd Description An HTTP/2 state amplification issue exists that combines HPACK decompression amplification with Slowloris-style stream stalling. This allows amplified decoded header state to be retained by...
CVE-2025-65720
An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page...
SUSE CVE-2026-15768
Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: High...
CVE-2026-46458
ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. This allows an unauthenticated remote attacker to retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot. This...
CVE-2026-47730
A flaw was found in Twig, a template language for PHP. The HtmlDumper component, responsible for rendering profiler information, does not properly sanitize user-controlled template or profile names before including them in the HTML output. This vulnerability allows an attacker to inject malicious...
RLSA-2026:39183 Important: python3.12 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
SUSE CVE-2026-10051
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the...
firefox: thunderbird: Use-after-free in the Networking: HTTP component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Networking: HTTP component...
ROS-20260715-73-0032
The vulnerability of Google Chrome’s Skia graphics library is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created HTML page...
ROS-20260715-73-0014
The vulnerability of Google Chrome’s Blink rendering module is related to information representation errors in the user interface. Exploiting this vulnerability allows a malicious actor to replace the user interface with a specially created HTML page...
HttpClientCodec Network Data Compromise
The vulnerability of the HttpClientCodec component in the networking application development framework, used by servers and clients that utilize the Netty protocol, is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to compromise the...
ROS-20260715-73-0010
The vulnerability of the HTTP/2 protocol implementation in the Apache HTTP Server is related to a memory reclamation error. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure...
ROS-20260715-73-0015
The vulnerability of the Google Chrome browser’s Navigation function is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code using a specially created HTML page...
CVE-2025-65720
A critical command injection vulnerability in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system. The root cause is a "by design" weakness in the Model Context Protocol (MCP) architecture, specifically involving unsafe defaults in how configuration...