CVE-2025-54100

CVE-2025-54100 PowerShellのcurlは内部でInvoke-WebRequestを使用しています。 PS C:\Users\melih curl cmdlet Invoke-WebRequest at command pipeline position 1 Supply values for the following parameters: Uri:...

Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues: spacecmd was updated to version 5.2.10: Version 5.2.10: Pre-filter errata in systemapplyerrata to avoid using API calls for all existing errata bsc1267261 Version 5.2.9: Updated translation strings uyuni-tools was updated to version 5.2.17: Security issues...

CVE-2019-1332

CVE-2019-1332: Microsoft SQL Server Reporting Services における反射型クロスサイトスクリプティング 影響を受ける SSRS サーバーに送信された特別に細工された Web リクエストが適切にサニタイズされない場合、Microsoft SQL Server Reporting Services SSRS にクロスサイトスクリプティング XSS...

Astra Linux – Vulnerability in Squid

SQUID is vulnerable to HTTP request smuggling, which is caused by the laxity of the chunked decoder. This allows a remote attacker to perform Request/Response smuggling beyond the firewall and frontend security systems...

Astra Linux – Vulnerability in freeipa

A flaw was discovered in FreeIPA. This issue may allow a remote attacker to create an HTTP request with parameters that can be interpreted as command arguments for kinit on the FreeIPA server, resulting in a denial of service...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.52 and earlier fail to close inbound connections when errors occur during the discarding of the request body, exposing the server to HTTP Request Smuggling attacks...

EUVD-2026-55240

A server-side request forgery SSRF vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action...

Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

Summary Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access Vulnerability Details CVEID:CVE-2026-11932 DESCRIPTION: IBM Security Verify Identity Access is vulnerable to a denial of service attack. CWE:CWE-835: Loop with Unreachable Exit...

nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...

MAL-2026-13633 Malicious code in modern-localization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4be23667d11e7ef3357641973b9188175c2068bd2b580a5628773bcdf03533a5 On server-side require of modern-localization, the package's main entry runs a top-level async IIFE syncLanguageSystem that performs an HTTP GET...

Linux Distros Unpatched Vulnerability : CVE-2026-43628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers ...

CVE-2026-43628 llama.cpp b3978–b9058 Integer Underflow via DRY Sampler

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

SUSE CVE-2026-67181

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...

The vulnerability of the Mojo web browser component in Google Chrome, which allows a hacker to trigger a service failure

The vulnerability of the Mojo web browser component in Google Chrome is related to errors in handling HTTP requests. Exploiting this vulnerability can allow an attacker to cause a service failure using a malicious file...

The vulnerability of the Font component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Font component in Google Chrome and Microsoft Edge relates to errors in HTTP request processing. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

EulerOS 2.0 SP13 : libsoup (EulerOS-SA-2026-2977)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soupbodyinputstreamreadchunked functio...

CVE-2026-9190

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

CVE-2026-9190 HTTP request smuggling in Progress MarkLogic Server

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

Malicious code in editor_application (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5914405fc5126f1abcc621e835b7e71774fb1b49cc51d5f02e808292769eb25 package.json declares a preinstall hook that runs node callback.js, which on npm install collects host-level identifiers os.hostname, os.userInfo...

Malicious code in @nextco/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2af3efee911b20157dcf0e84f2be91affddf4e34aac298e1959ea7090f08c4d2 On require, index.js unconditionally calls a telemetry function at module top level that collects host reconnaissance hostname, username, dirname, cw...