Improper Handling of Highly Compressed Data (Data Amplification)

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the Decompress middleware. An attacker can exhaust memory or CPU resources by sending a small,...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the Decompress middleware. An attacker can exhaust memory or CPU resources by sending a small,...

GHSA-CXF3-9H37-7RR8 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were...

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were...

Incorrect Authorization

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Incorrect Authorization in the Proxy process. An attacker can gain unauthorized access to protected resources by sending a WebSocket upgrade request that is reject...

Incorrect Authorization

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Incorrect Authorization in the Proxy process. An attacker can gain unauthorized access to protected resources by sending a WebSocket upgrade request that is reject...

Allocation of Resources Without Limits or Throttling

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the BodyDump middleware. An attacker can exhaust process memory and disrupt service availability by...

Allocation of Resources Without Limits or Throttling

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the BodyDump middleware. An attacker can exhaust process memory and disrupt service availability by...

Oracle WebCenter Sites (October 2026 CPU)

The 12.2.1.4.0 and 14.1.2.0.0 versions of WebCenter Sites installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites Apache Log4j...

Node.js Module TanStack Start 1.143.12 < 1.168.56 / 1.168.57 / 1.168.60 / 1.169.39 XSS (CVE-2026-102989)

The versions of the TanStack Start Node.js modules installed on the remote host are 1.143.12 or later, prior to their respective patched versions. They are, therefore, affected by a cross-site scripting vulnerability: - The server-function transport passes request payload fields into internal...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-poc — Go edition A Go toolkit for CVE-2026-109618...

middleware-apm (>=0.1.29, <=0.1.37) potentially affected by CVE-2026-113721 via virtualenv (20.0.17)

virtualenv PYPI version 20.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - middleware-apm =0.1.29, =0.1.37 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangChain (CVE-2026-55443)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangChain, due to several LangChain components that resolve filesystem paths or expand search patterns that do not consistently confine the resolved path to the intended root directory. LangChain is used in our Spee...

GHSA-MCHM-GJX6-7H55 Sentry-Javascript: Middleware Bypass when using Tunnel route

Impact The tunnelRoute option makes the SDK send browser events to a path on your own Next.js server for example /monitoring, where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips...

EUVD-2026-107549

Sentry-Javascript: Middleware Bypass when using Tunnel route...

Sentry-Javascript: Middleware Bypass when using Tunnel route

Impact The tunnelRoute option makes the SDK send browser events to a path on your own Next.js server for example /monitoring, where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips...

CVE-2026-115333

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashedkey. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ ...

CVE-2026-115333 Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashedkey. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ ...

CVE-2026-115333 Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashedkey. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ ...

CVE-2026-115333 Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashedkey. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ ...