CVE-2026-13158

The Everest Toolkit WordPress plugin (versions 1.2.3) and implement proper upload handling (e.g., using WordPress wp_handle_upload with strict whitelisting) plus server rules to prevent PHP execution in uploads. If exploiting evidence exists, PoCs or in-wild links are mentioned within connected ...

SUSE CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

PT-2026-67051

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

PT-2026-67027

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp get svg content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

PT-2026-67576

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x and earlier Node.js versions 24.x and earlier Node.js versions 26.x and earlier Description A flaw in the Node.js HTTP client can lead to request desynchronization in Node.js-based forwarding proxies. This occurs when...

Linux Distros Unpatched Vulnerability : CVE-2026-64607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or...

EUVD-2026-36574

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes...

Security Bulletin: IBM Storage Protect Server is affected by multiple vulnerability in the netty-codec-http library that could allow an attacker to exploit integer overflow conditions when processing chunked HTTP requests(CVE-2026-42581, CVE-2026-42584).

Summary IBM Storage Protect Server uses the netty-codec-http library in certain components. Netty is vulnerable to multiple vulnerability that could allow an attacker to exploit integer overflow conditions when processing chunked HTTP requests. This may lead to inconsistent request parsing and...

EUVD-2026-51596

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

CVE-2026-21858-and-CVE-2025-68613

Ni8mare: n8n Pre-Auth RCE CVE-2026-21858 & CVE-2025-68613 —...

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

GHSA-HJCP-JMPX-G3QM Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

Code Injection

datamodel-code-generator is vulnerable to Code Injection. The vulnerability is due to insufficient validation of x-python-type values from attacker-controlled JSON Schema content before inserting them into generated Python field annotations, which allows an attacker to execute arbitrary Python co...

CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

UBUNTU-CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-18436

The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint POST /wp-json/mailpress/v1/campaign//restore-revision/. The route in the vulnerable range was registered without a permissionCallback,...

EUVD-2026-51519

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-64607

The CVE concerns Apache HttpComponents Client (HttpClient, classic I/O model). A defect occurs when the client encounters an invalid or unsupported Content-Encoding header in a response, failing to correctly release the underlying connection back to the connection manager. This can lead to connec...

CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...