CVE-2026-83005

Oracle WebCenter Enterprise Capture (component: Client Bundle ), part of Oracle Fusion Middleware, is vulnerable in supported versions 12.2.1.4.0 and 14.1.2.0.0 . The flaw allows a low-privileged attacker with network access via HTTP to compromise the product and achieve takeover , with high impa...

com.alejandrohdezma:scala-steward-core_2.13 (>=0.11.0, <=0.11.1), com.codacy:kamon-http4s-1.0_2.13 (>=0.0.1, <=0.1.2) +65 more potentially affected by CVE-2026-69215 via org.http4s:http4s-client_2.13 (>=1.0.0-m2, <=1.0.0-m46)

org.http4s:http4s-client2.13 MAVEN version =1.0.0-m2, =0.11.0, =0.0.1, =0.5.0, =1.3.0, =0.9.0-m2, =5.0.0-rc1, =5.0.0-rc1, =3.3.0-rc1, =0.0.1, =0.16.0, =0.0.73, =0.1.90, =0.1.90, =0.1.90, =0.2.4 and more Source cves: CVE-2026-69215 Source advisory: GHSA-GRH8-3P95-F9RR...

Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

The CookieJar client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for example.com is therefore sent to any host whose name merely contains...

com.armanbilge:feral-lambda-cloudformation-custom-resource_2.12 (>=0.1-f497734, <=0.1-7d4b1e7), com.armanbilge:sbt-bundlemon_2.12_1.0 (0.1.4) +69 more potentially affected by CVE-2026-69206 via org.http4s:http4s-ember-core_2.12 (>=0.10.0-m10, <=0.23.34)

org.http4s:http4s-ember-core2.12 MAVEN version =0.10.0-m10, =0.1-f497734, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.0-3-cca5341b, =0.0.0-3-cca5341b, =7.1.0, =0.21.0, =0.20.4, =0.21.0, =0.21.0, =0.22.1 and more Source cves: CVE-2026-69206 Source advisory: MEND:CVE-2026-69206...

CVE-2026-69218

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without ENDHEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound. A remote peer can keep an incomplete bloc...

CVE-2026-69203

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGSMAXCONCURRENTSTREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining...

CVE-2026-84850

Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate...

CVE-2026-84850

Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate...

CVE-2026-84850

Devolutions Server version 2026.2.16 and earlier is vulnerable to improper certificate validation in the shared HTTP client used by synchronization and integration features. This flaw allows a network-positioned attacker to intercept and tamper with outbound TLS connections by utilizing a spoofed...

CVE-2026-84850

Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate...

EUVD-2026-79188

Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate...

CVE-2026-69213 Http4s Ember HTTP/2: unbounded outbound frame queue

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by writeLoop. When the peer stops reading, an unauthenticated HTTP/2 client can continue sending PING, SETTINGS, or DATA frames that cause...

EUVD-2026-79025

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary...

Malicious Package

Overview id79-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview @biz44/id12-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @biz44/id10-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @biz44/id99-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @biz44/id79-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @biz44/id95-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @biz44/id44-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...