CVE-2026-42945

A flaw was found in NGINX, specifically within the ngxhttprewritemodule. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests under specific rewrite configurations. This can lead to a heap buffer overflow in the NGINX worker process, which may result in...

Mozilla: Taskcluster web-server OAuth2 authorization codes are reusable and the exchange handler checks the wrong expiry column

The Taskcluster web-server's OAuth2 token-exchange handler did not consume authorization codes and did not enforce the authorization-code expiry. A leaked authorization code could be replayed to mint additional bridge access tokens for the original user, past the 10-minute window required by the...

knet-exploit-2013

KNet Web Server 1.04b Remote...

WS-2018-0016

A crafted GET request can be leveraged to traverse the directory structure of a host using the lactate web server package, and request arbitrary files outside of the specified web root...

PT-2026-40944

Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a...

The vulnerability of the web server of the microprogrammed software for industrial-controlled switches PLANET IGS-5225-8P2T4S allows a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the web server of the microprogrammed software for industrial-controlled switches PLANET IGS-5225-8P2T4S lies in the escape of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

The vulnerability of the web server of the microprogrammed software for industrial-controlled switches PLANET IGS-5225-8P2T4S allows a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the web server of the microprogrammed software for industrial-controlled switches PLANET IGS-5225-8P2T4S lies in the escape of operations beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or execute arbitrary code...

The vulnerability of the web server of the microprogramming software for industrial-controlled switches PLANET IGS-5225-8P2T4S allows a hacker to execute arbitrary commands and increase their privileges.

The vulnerability of the web server of the microprogrammed software for industrial-controlled switches PLANET IGS-5225-8P2T4S is related to the absence of filtering for user-input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely and increase thei...

EUVD-2025-209828

The locally served web site on the Garmin WDU v1 1.4.6 and v2 5.0 allows a symlink attack. If a malicious graphics package containing symlinks is uploaded, the web server follows the supplied links when serving content. No mechanisms to restrict those link targets to a specific area of the...

EUVD-2026-29973

When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2026-8466 Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing. cowboyreq:readpart/3 in src/cowboyreq.erl accumulates incoming request bytes into a Buffer binary with no upper-bound chec...

Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by WebSphere Application Server affect IBM Business Automation Workflow

Summary WebSphere Application Server Traditional is shipped as a component of IBM Business Automation Workflow. WebSphere Application Server Liberty is shipped as part of the optional components Process Federation Server since 8.5.6, and User Management Service since 18.0.0.1 in IBM Business...

CVE-2026-42946

A vulnerability exists in the ngxhttpscgimodule and ngxhttpuwsgimodule modules that may result in excessive memory allocation or an over-read of data. When scgipass or uwsgipass is configured, an unauthenticated attacker with man-in-the-middle MITM ability to control responses from an upstream...

CVE-2026-40701

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpsslmodule module when the sslverifyclient directive is set to "on" or "optional," and the sslocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacke...

CVE-2026-40435

When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2026-40701

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpsslmodule module when the sslverifyclient directive is set to "on" or "optional," and the sslocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacke...

CVE-2026-39455 BIG-IP Configuration utility vulnerability

When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol LDAP authentication, undisclosed traffic can cause the httpd process to exhaust the available file descriptors. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2025-27850

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) is vulnerable to a symlink attack . The root cause is the lack of mechanisms to restrict link targets to specific filesystem areas, allowing the web server to follow symlinks within a maliciously uploaded graphics package. This e...

CVE-2025-27850: Improper Link Resolution Before File Access

The locally served web site on the Garmin WDU v1 1.4.6 and v2 5.0 allows a symlink attack. If a malicious graphics package containing symlinks is uploaded, the web server follows the supplied links when serving content. No mechanisms to restrict those link targets to a specific area of the...

CVE-2025-27850

The locally served web site on the Garmin WDU v1 1.4.6 and v2 5.0 allows a symlink attack. If a malicious graphics package containing symlinks is uploaded, the web server follows the supplied links when serving content. No mechanisms to restrict those link targets to a specific area of the...