145349 matches found
EUVD-2023-60690
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...
CVE-2024-14029 Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling...
CVE-2026-53957
Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, exportspace and importspace in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and...
Security Bulletin: Multiple Security Vulnerabilities in IBM WebSphere Application Server Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-10842 DESCRIPTION: IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional...
EUVD-2026-78590
Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, exportspace and importspace in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and...
CVE-2026-89025 Hirschmann HiOS Switch Platform DoS via Malformed HTTP Request
Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of HTTPS content. A remote unauthenticated attacker can send a specially crafted HTTPS request to a specific endpoint that is processed incorrectly, causing the...
EUVD-2026-78581
Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of HTTPS content. A remote unauthenticated attacker can send a specially crafted HTTPS request to a specific endpoint that is processed incorrectly, causing the...
CVE-2026-53659
A flaw was found in http4k, a functional toolkit for Kotlin HTTP applications. The ServerFilters.GZip and RequestFilters.GunZip functions, along with underlying Gzip request-body decompression, do not limit the decompressed size of incoming data. An unauthenticated client can exploit this by...
CVE-2026-52823 Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/id/stop and GET /api/timesheets/id/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense...
CVE-2026-52823 Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/id/stop and GET /api/timesheets/id/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense...
CVE-2026-52823 Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/id/stop and GET /api/timesheets/id/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense...
EUVD-2026-78404
Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/id/stop and GET /api/timesheets/id/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense...
CVE-2026-52823
Kimai , an open-source time tracking application, contains an authenticated CSRF vulnerability in its TimesheetController (src/API/TimesheetController.php). Prior to version 2.58.0 , the stop and restart operations were exposed as GET requests without a request-forgery defense, while reusing the ...
CVE-2026-91857
Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: - EventReportsController::purgeUnusedPictures - NoticelistsController::enableNoticelist - ServersController::removeOrphanedCorrelations -...
CVE-2026-44202
OpenAM (Open Identity Platform), an open-source IAM platform derived from ForgeRock, has an authenticated SSRF vulnerability in the /sessionservice addSessionListener operation. Prior to 16.1.1 , an authenticated user can register an arbitrary notification URL without requiring an administrative ...
CVE-2026-91857 MISP: State-changing actions accessible via GET request enabling CSRF
Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: - EventReportsController::purgeUnusedPictures - NoticelistsController::enableNoticelist - ServersController::removeOrphanedCorrelations -...
CVE-2026-91857 MISP: State-changing actions accessible via GET request enabling CSRF
Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: - EventReportsController::purgeUnusedPictures - NoticelistsController::enableNoticelist - ServersController::removeOrphanedCorrelations -...
CVE-2026-91819
Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...
Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed WebSphere Application Server is affected by an HTTP request smuggling vulnerability (CVE-2026-11710)
Summary The security issue described in CVE-2026-11710 has been identified in WebSphere Application Server included as part of IBM Tivoli Composite Application Manager for Application Diagnostics Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affecte...
