CVE-2026-67424

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial...

CVE-2026-67426

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verificationservice.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callbackurl for an outbound POST with X-Internal-Key:...

CVE-2026-16328

In consul-mcp-server, versions 0.1.0–0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server’s Consul address via a request header. This could redirect the server’s Consul API traffic to an attacker-controlled endpoint and potentially...

CVE-2026-16328

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an...

CVE-2026-16328 consul-mcp-server vulnerable to server side request forgery leading to token exposure

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an...

CVE-2026-67424

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial...

CVE-2026-59919

Netty CVE-2026-59919 affects the HAProxy encoder (HAProxyMessageEncoder) in Netty versions prior to 4.1.136.Final and 4.2.16.Final. The encoder writes AF_UNIX source/destination addresses into the HAProxy V1 text protocol without validating for CRLF, allowing an attacker who controls an AF_UNIX a...

CVE-2026-15144

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range a /64 holds 2^64 distinct addresses and the same address has multiple valid textual representations, an IPv6 capable...

CVE-2026-15144 @fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range a /64 holds 2^64 distinct addresses and the same address has multiple valid textual representations, an IPv6 capable...

CVE-2026-15144

The vulnerability CVE-2026-15144 affects @fastify/rate-limit prior to version 11.2.0. It buckets rate-limit keys using the verbatim client IP string from request.ip, allowing an IPv6 client to control a large address range (a /64) and bypass limits by rotating addresses or using different textual...

CVE-2026-55707

An authorization bypass was found in the OpenStack Neutron subnetpool onboarding API endpoint PUT /v2.0/subnetpools/id/onboardnetworksubnets. When a caller supplies a networkid, the API only verifies that the network is visible to the caller but does not verify that the caller owns the subnets on...

EUVD-2026-50365

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...

CVE-2026-54662 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...

CVE-2026-18174

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

CVE-2026-18174 @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

CVE-2026-18174 @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

EUVD-2026-50332

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

CVE-2026-59883

A flaw was found in Guzzle, an extensible PHP HTTP client. The CookieJar component improperly handled cookies for IP-address or bare-numeric domains, failing to restrict them to the exact host. This vulnerability could allow a remote attacker to disclose cookies across different hosts, inject...

EUVD-2026-50223

The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...

CVE-2026-58159

Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix...