PT-2026-95697

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw in the HTTP/1 decoder allows remote attackers to perform HTTP request smuggling due to incomplete validation of malformed Transfer-Encoding headers. By sending specially crafted HTTP...

PT-2026-95511

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw in the HTTP/2 stack allows a remote attacker to inject prohibited characters, including NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validatio...

CVE-2026-86796: Protection Mechanism Failure

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows...

PT-2026-95437

Name of the Vulnerable Software and Affected Versions IBM Common Licensing Agent versions 9.0 through 9.0.0.2 IBM ART versions 9.0 through 9.0.0.2 Description Cross-site request forgery allows an attacker to execute malicious and unauthorized actions by transmitting requests from a user that the...

PT-2026-95466

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 8.5 IBM WebSphere Application Server version 9.0 IBM WebSphere Liberty affected versions not specified Description IBM WebSphere Application Server and Liberty are susceptible to HTTP request smuggling,...

EulerOS 2.0 SP15 : libsoup (EulerOS-SA-2026-3785)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soupbodyinputstreamreadchunked functio...

PT-2026-95287

Name of the Vulnerable Software and Affected Versions WP Multi Store Locator Pro versions prior to 4.5.2 Description An issue exists where unauthenticated attackers can perform SQL Injection by appending additional queries to existing ones to extract sensitive database information. This occurs...

Cisco Identity Services Engine (cisco-sa-ise-rce-se7bYU57)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must...

EulerOS Virtualization 2.12.0 : perl-HTTP-Tiny (EulerOS-SA-2026-3660)

According to the versions of the perl-HTTP-Tiny package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.When the server return...

PT-2026-95609

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

PT-2026-95419

Name of the Vulnerable Software and Affected Versions gedelumbung HospitalManagement versions up to c2d45543789a3887067d3915f69d44cfc2cf76a8 Description A weakness allows for cross-site request forgery, which can be initiated remotely. Cross-site request forgery is a type of attack that tricks a...

PT-2026-95218

Name of the Vulnerable Software and Affected Versions django-page-cms versions prior to 2.0.14 Description Five admin mutation views in pages/admin/views.py are exempt from Cross-Site Request Forgery CSRF protection. This allows attackers to forge requests that modify page content. Signed-in...

CVE-2026-11725: Integer Overflow or Wraparound

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing...

CVE-2026-63405: Insufficient Verification of Data Authenticity

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied bodymd5 value in the HMAC input but does not calculate the digest of the received request body or compare it...

CVE-2026-93579: Undefined Security Weakness

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

CVE-2026-79713: Inconsistent Interpretation of HTTP Requests

The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from...

CVE-2026-93562: Undefined Security Weakness

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...

CVE-2026-93573: Inconsistent Interpretation of HTTP Requests

A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass Transfer-Encoding header validation by splitting the Transfer-Encoding field across multiple headers, with the last field containing a non-final transfer coding like gzip or deflate. This bypass ca...

CVE-2026-11710: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

PT-2026-95259

Name of the Vulnerable Software and Affected Versions Hide My WP Ghost versions prior to 7.0.11 Description The plugin fails to verify if a request is a genuine WooCommerce request before disabling its firewall, threat-detection, and login/URL-hiding protections. An unauthenticated attacker can...