Linux Distros Unpatched Vulnerability : CVE-2026-58216

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded...

Linux Distros Unpatched Vulnerability : CVE-2026-58178

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through...

Linux Distros Unpatched Vulnerability : CVE-2026-58181

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Apache Traffic Server urisigning and urlsig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0...

Linux Distros Unpatched Vulnerability : CVE-2026-58182

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Apache Traffic Server tslua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0....

PT-2026-65760

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the iss...

TencentOS Server 4: httpd (TSSA-2026:0759)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0759 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CVE-2026-56822 Netty: TOCTOU in OcspServerCertificateValidator

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to se...

CVE-2026-56822

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to se...

CVE-2026-66064

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection...

CVE-2026-66063

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This...

CVE-2026-49447

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:39+00:00| published-proof-of-concept| https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-5fqm-cc34-fcf5...

CVE-2026-49446

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:37+00:00| published-proof-of-concept| https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659...

openhole-server vulnerable to path traversal via URL-decoded request path

Summary openhole-server forwarded the URL-decoded request path r.URL.Path to tunnel clients instead of the original request-target. Percent-encoded dot-segments %2e and separators %2f were decoded to ../ and / before reaching the local service. Go's ServeMux rejects literal ../ paths, but...

CVE-2026-54650 openhole-server vulnerable to path traversal via URL-decoded request path

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

CVE-2026-54650 openhole-server vulnerable to path traversal via URL-decoded request path

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

EUVD-2026-50087

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

CVE-2026-54650

CVE-2026-54650 describes a path traversal vulnerability in openhole-server prior to 0.1.2. In 0.1.1 and earlier, internal/server/public_proxy.go forwarded the request using r.URL.Path instead of preserving the original target via r.URL.EscapedPath(). This allowed percent-encoded dot segments (%2e...

CVE-2026-54690

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or...

CVE-2026-54691

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...

CVE-2026-47219 find-my-way is Vulnerable to DDoS with HTTP2

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup function passes req.method into...