httpd: httpd: Information disclosure in mod_userdir via single-dot path equivalence

A flaw was found in Apache HTTP Server's moduserdir module. When configured with an absolute path without wildcards for the UserDir directive, the server fails to properly resolve single-dot directory '/./' path equivalence. A remote attacker can exploit this issue by submitting a crafted HTTP...

CVE-2026-47360

A flaw was found in Apache HTTP Server's modsessioncookie module. When internal redirects alter the SessionCookieRemove configuration, the server may fail to strip the session cookie as expected. This issue can lead to information disclosure by inadvertently forwarding sensitive user session toke...

CVE-2026-56449

A flaw was found in the modproxyhtml module of Apache HTTP Server. An attacker who controls or manipulates HTTP response bodies processed by the proxy can trigger an out-of-bounds memory write. This issue can cause the server process to crash, resulting in a Denial of Service DoS. Mitigation...

CVE-2026-48005

A flaw was found in the modauthdigest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of...

CVE-2026-42356

A flaw was found in Apache HTTP Server. An attacker could achieve unintended code execution when an internal redirect generated by a Common Gateway Interface CGI program points to a non-executable file. If the target file resides in a directory configured for CGI execution and lacks a file...

Sonicwall - Pre-Authentication Arbitrary File Read

Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure...

Apache Log4j2 - Remote Code Injection

Apache Log4j2 Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations. id: CVE-2021-45046 info: name: Apache Log4j2 - Remote Code Injection author: ImNightmaree severity: critical description: Apache Log4j2 Thread Context Lookup Pattern is...

CVE-2026-58415

A flaw was found in the moddavfs module of the Apache HTTP Server. A remote attacker can exploit this vulnerability by sending an HTTP GET request directly to the internal WebDAV Web Distributed Authoring and Versioning state directory. This allows unauthorized access to internal state files,...

CVE-2026-42528

A flaw was found in the moddav module of the Apache HTTP Server. This vulnerability allows a Denial of Service DoS by crashing server child processes. An attacker with permission to create Web Distributed Authoring and Versioning WebDAV locks can trigger a memory calculation error during lock...

CVE-2026-63718

A flaw was found in the modproxyuwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentiall...

CVE-2026-73636

A flaw was found in the modauthdigest module of the Apache HTTP Server. This vulnerability allows an attacker positioned on the network to bypass authentication by replaying previously intercepted user credentials. When the server is configured with a nonce a single-use security token lifetime of...

CVE-2026-63686

A flaw was found in the modxml2enc module of the Apache HTTP Server. An untrusted backend server can cause a Denial of Service DoS by returning a crafted response with a character set whose conversion partially succeeds and then fails. Processing this response triggers an invalid memory access nu...

CVE-2026-46729

A flaw was found in the modheartmonitor module of the Apache HTTP Server. A remote, unauthenticated attacker can exploit a NULL pointer dereference vulnerability when the module is configured with a unicast listener. By sending specially crafted network traffic to the listening service, an attack...

CVE-2026-79768

A flaw was found in Apache HTTP Server's moduserdir module. When configured with an absolute path without wildcards for the UserDir directive, the server fails to properly resolve single-dot directory '/./' path equivalence. A remote attacker can exploit this issue by submitting a crafted HTTP...

EUVD-2009-5121

ContentKeeper Web Appliance now maintained by Impero Software versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as t...

PT-2026-104308

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An infinite loop occurs in the Apache Thrift python bindings due to an unreachable exit condition. Recommendations Upgrade to version 0.25.0...

PT-2026-104303

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description A loop with an unreachable exit condition, resulting in an infinite loop, exists within the c glib bindings. Recommendations Update to version 0.25.0...

PT-2026-104314

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An uncaught exception issue exists within the Apache Thrift Perl bindings. Recommendations Upgrade to version 0.25.0...

PT-2026-104310

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An issue exists in the Apache Thrift ruby bindings where resources are allocated without limits or throttling. This can lead to excessive resource consumption. Recommendations Update to versio...

PT-2026-104324

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description The protocol skip routine in several Apache Thrift bindings fails to apply the recursion limit. This allows a message containing deeply nested unknown fields to exhaust the stack, potentially...