CVE-2026-73228

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

CVE-2026-73228 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

CVE-2026-73228

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

EUVD-2026-54993

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection...

CVE-2026-14238: Improper Neutralization of Special Elements used in an SQL Command

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection...

MaxBodyLength Limit Bypass

axios is vulnerable to a maxBodyLength limit bypass. The vulnerability is due to the HTTP/2 request API not enforcing the configured maxBodyLength limit and axios's byte-counting stream wrapper being conditionally applied, which allows an attacker who controls a streamed request body to transmit...

CVE-2026-19113 Unauthenticated denial of service via unbounded request body processing

Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, i...

CVE-2026-19113

CVE-2026-19113 affects Consul Community Edition and Consul Enterprise versions 1.3.0–2.0.2, with an unauthenticated denial-of-service arising from unbounded request body processing on several agent HTTP API endpoints. A remote caller can cause the agent to consume a large amount of memory before ...

CVE-2026-54199 TeamDavid: Header Injection through request body in link storing functionality

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality //ServerClientcelink.htm, which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to...

CVE-2026-54199

Tobit Laboratories AG TeamDavid’s Webbox is vulnerable to HTTP header injection via the request body in the link-storing function (//ServerClient_celink.htm), which is appended to the redirect target in the 302 response. Inserting a line feed can propagate into the redirect URL, enabling control ...

CVE-2026-54199 TeamDavid: Header Injection through request body in link storing functionality

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality //ServerClientcelink.htm, which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to...

PT-2026-69124

Name of the Vulnerable Software and Affected Versions Consul Community Edition versions 1.3.0 through 2.0.2 Consul Enterprise versions 1.3.0 through 2.0.2 Description An unauthenticated denial of service exists in several agent HTTP API endpoints due to unbounded request body processing. A remote...

CVE-2026-18258 Authorization Bypass Through User-Controlled Key in eScriptorium

Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are...

CVE-2026-18258 Authorization Bypass Through User-Controlled Key in eScriptorium

Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are...

CVE-2026-70646 aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the island renderer endpoint when attacker-controlled input is decoded and hashed before URL-resident hash validation. An attacker can exhaust CPU resources and degrade or stall t...

CVE-2026-71236 Grocy - Stored XSS via HTMLPurifier Output Double-Decode

Grocy's API request-body parser controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing , , and back to , and & immediately after purification...

EUVD-2026-53211

The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...

PT-2026-68065

Name of the Vulnerable Software and Affected Versions Rancher Manager affected versions not specified Description When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. This occurs because the audit...

CVE-2026-15314: Buffer Copy without Checking Size of Input

Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash...