Kong Gateway Enterprise environmental issues and vulnerabilities

Kong Gateway Enterprise is an enterprise-level API gateway platform developed by Kong Corporation. Versions 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 of Kong Gateway Enterprise contain environmental issues vulnerabilities. These vulnerabilities stem from defects in the HTTP request processing pipelin...

cpp-httplib parse_header() Data Compromise

The vulnerability of the parseheader function in the cpp-httplib library is related to deficiencies in HTTP request processing. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

ASGI Request Header Handler Bypass

The vulnerability of the Request Header Handler component in the Starlette framework for web development is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...

aiohttp HTTP Client Request Manipulation

The vulnerability of the aiohttp HTTP client is related to deficiencies in request processing. Exploiting this vulnerability allows an attacker who operates remotely to carry out attacks by replacing HTTP requests with malicious content...

UBUNTU-CVE-2026-43424

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: Fix NULL pointer dereferences in nexus handling The tpg-tpgnexus pointer in the USB Target driver is dynamically managed and tied to userspace configuration via ConfigFS. It can be NULL if the USB host sends...

CVE-2026-43424 usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: Fix NULL pointer dereferences in nexus handling The tpg-tpgnexus pointer in the USB Target driver is dynamically managed and tied to userspace configuration via ConfigFS. It can be NULL if the USB host sends...

Hanwha Vision QND-8080R Access Control Vulnerability

Hanwha Vision QND-8080R is a network infrared surveillance camera device produced by Hanwha Vision in South Korea. The Hanwha Vision QND-8080R has a access control vulnerability, which stems from issues with request processing. This vulnerability may lead to accidental access to protected functio...

Spring Framework DoS with Multipart Temp Files in WebFlux

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space...

Improper Authentication

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Improper Authentication in processOCSPRequest, which is part of the the CLIENTCERT authentication process. In some "edge cases", an attacker can trigger a soft-fail...

Next.js HTTP Request Processing Privilege Escalation

The vulnerability of the Next.js web application development software platform is related to shortcomings in HTTP request processing. Exploiting this vulnerability allows an attacker to compromise the confidentiality and integrity of the protected information...

EUVD-2026-17767

Addressed a potential insecure direct object reference IDOR vulnerability in the signing invitation acceptance process. Under certain conditions, this issue could have allowed an attacker to access or modify unauthorized resources by manipulating user-supplied object identifiers, potentially...

CVE-2026-4947

Addressed a potential insecure direct object reference IDOR vulnerability in the signing invitation acceptance process. Under certain conditions, this issue could have allowed an attacker to access or modify unauthorized resources by manipulating user-supplied object identifiers, potentially...

CVE-2026-27686

Due to a Missing Authorization Check in SAP Business Warehouse Service API, an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request...

CVE-2026-27686 Missing Authorization check in SAP Business Warehouse (Service API)

Due to a Missing Authorization Check in SAP Business Warehouse Service API, an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request...

PT-2026-24162

Due to a Missing Authorization Check in SAP Business Warehouse Service API, an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request...

kernel: RDMA/siw: Fix connection failure handling

A NULL dereference vulnerability was found in the Linux kernel, which is caused when the siwcmworkhandler function attempts to dereference a NULL listener that may be created when immediate MPA request processing fails and the newly created endpoint unlinks the listening endpoint ready to be...

cpp-httplib HTTP Request Hijacking

The vulnerability of the cpp-httplib library is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and carry out an “HTTP request hijacking” attack...

OESA-2025-2854 cpp-httplib security update

A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include httplib.h file in your code! Security Fixes: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled...

UxPlay security vulnerability

UxPlay is an AirPlay server software by antimof individual developers. A security vulnerability exists in UxPlay version 1.72, which stems from the presence of a double release for RTSP request processing, which could lead to a denial of service...

IBM OpenPages Cache Poisoning

The vulnerability of IBM OpenPages, a risk management platform for enterprises, is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to perform a cache poisoning attack or intercept sessions by sending specially crafted HTTP requests remote...