CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

CVE-2026-92708

Svelte devalue is a JavaScript serialization library for use with SvelteKit, Nuxt, and other frameworks. In versions 5.1.0 through 5.9.2 , the stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view. Since a Node Buffer's backing...

WordPress Wow Elements Addons for Elementor plugin <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery vulnerability

Authenticated Contributor+ Server-Side Request Forgery vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Waris Damkham in WordPress Plugin Wow Elements Addons for Elementor versions = 1.11.2...

CVE-2026-11722

CVE-2026-11722 is an HTTP request smuggling vulnerability (CWE-444) affecting IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8). The vulnerability requires no authentication and has high attack complexity, with lo...

EUVD-2026-83290

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability...

CVE-2026-11722 IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability...

CVE-2026-11722 IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability...

CVE-2026-11710 IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

EUVD-2026-83287

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

CVE-2026-11710 IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

CVE-2026-11710

IBM WebSphere Application Server 8.5 (versions 8.5.5.0 through 8.5.5.30) is vulnerable to HTTP request smuggling caused by improper handling of Content-Length headers (CWE-444). The flaw allows an attacker to send crafted requests that are interpreted differently by the server versus downstream c...

CVE-2026-93840

vLLM before 0.29.0 is vulnerable to cross-request logits corruption via the allowed_token_ids parameter. The root cause is in SamplingParams._validate_allowed_token_ids() , which validates token IDs against the tokenizer length rather than the model output logits width. An attacker can supply tok...

CVE-2026-93840 vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids

vLLM before 0.29.0 validates allowedtokenids against tokenizer length instead of model output logits width in SamplingParams.validateallowedtokenids. Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow...

CVE-2026-11548 IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling

IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability...

CVE-2026-11548

CVE-2026-11548 is an HTTP request smuggling vulnerability (CWE-444) affecting IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8). The CVSS 3.1 score is 4.8 (Medium) , with a network attack vector, high complexity, ...

CVE-2026-11548 IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling

IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability...

EUVD-2026-83281

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability...

DEBIAN-CVE-2026-93579

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

CVE-2026-93579

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

UBUNTU-CVE-2026-93579

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...