CLEANSTART-2026-ET22170 undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response

Security vulnerability affects the langfuse-worker package. undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response...

wasi-http p2: outgoing content-length can be invalid or not match body

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h4wp-g4x3-7398 For more information see the GitHub-hosted security advisory...

CLEANSTART-2026-CJ83222 undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response

Security vulnerability affects the langfuse package. undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response...

Casdoor authentication server is vulnerable to authorization bypass

Overview Casdoor is an open-source Access Management IAM platform used to manage web applications. An authorization bypass vulnerability affects Casdoor versions up to v4.2.0. The vulnerability allows a non-global organization administrator to perform unauthorized administrative actions against...

CVE-2026-67329

@better-auth/stripe versions = 1.4.11 and = 1.7.0-beta.0 and 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the...

CVE-2026-67329 @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription

@better-auth/stripe versions = 1.4.11 and = 1.7.0-beta.0 and 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the...

PT-2026-45367

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2 Description A bug in the bulk Task Instances API allows an authenticated UI or API user to bypass authorization and mutate Task Instance states across different DAGs. The system evaluates authorization...

CVE-2026-34762 Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/imsi API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's polic...

CVE-2026-34762 Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/imsi API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's polic...

PT-2025-50124

Name of the Vulnerable Software and Affected Versions Outsystems Platform Server version 11.18.1.37828 Description A flaw exists in Outsystems Platform Server that enables attackers to trigger a denial of service. This is achieved by submitting requests with a crafted Content-Length value that do...

DEBIAN-CVE-2014-3571

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake bod...