Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the errors middleware process. An attacker can obtain sensitive authentication headers, such as Authorization and Cookie, by triggering a backend response that matches the configured...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the errors middleware process. An attacker can obtain sensitive authentication headers, such as Authorization and Cookie, by triggering a backend response that matches the configured...

GHSA-P6HG-QH38-555R Traefik's errors middleware forwards Authorization and Cookie headers to separate error page service

Summary There is a medium severity information disclosure vulnerability in Traefik's errors custom error pages middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request's complete header set, including Authorization, Cookie,...

Traefik's errors middleware forwards Authorization and Cookie headers to separate error page service

Summary There is a medium severity information disclosure vulnerability in Traefik's errors custom error pages middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request's complete header set, including Authorization, Cookie,...

JLSEC-2026-397

When curl is used to retrieve and parse cookies from a HTTPS server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings...

Information Exposure

org.springframework.grpc, spring-grpc-core is vulnerable to information exposure through error messages. The vulnerability is due to returning raw server-side AuthenticationException messages in the gRPC status description, which allows an attacker to gather authentication failure details and...

PT-2026-40998

An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this...

The vulnerability of the PARSEC security subsystem, related to type conversion errors, allows a perpetrator to trigger a service failure.

The vulnerability of the PARSEC security subsystem is related to type conversion errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the extract_timestamp function in the Linux Audit storage and record-searching tool allows a perpetrator to trigger a service failure.

The vulnerability of the extracttimestamp function in the Linux Audit storage and record-searching tool is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the list.h component of the USButils utility allows a malicious actor to cause a service failure.

The vulnerability of the list.h component of the USButils utility is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the CUPS printing server, related to pointer arithmetic errors, allows a perpetrator to cause a service failure.

The vulnerability of the CUPS printing server is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

Vulnerability of the `parsec_sock_opt_del` function in Linux Astra Modules, allowing a hacker to cause a service failure

The vulnerability of the parsecsockoptdel function in Linux Astra Modules is related to errors during thread blocking. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the BPF Libbpf loader library, related to pointer dereferencing errors, allows a perpetrator to cause a service failure.

The vulnerability of the BPF Libbpf loader library is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the xmlStringGetNodeList() function in the tree.c component of the Libxml2 library, which is related to pointer manipulation errors, allows a malicious actor to cause a service failure.

The vulnerability of the xmlStringGetNodeList function in the tree.c component of the Libxml2 library is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the xmlMemStrdup() function in the Libxml2 library, which allows a hacker to cause a service failure.

The vulnerability of the xmlMemStrdup function in the Libxml2 library is related to pointer manipulation errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-37111

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.44 Traefik versions prior to 3.6.15 Traefik versions prior to 3.7.0-rc.3 Description An information disclosure issue exists in the errors custom error pages middleware. When a backend returns a response matching...

The vulnerability of the WebAssembly component in the Firefox web browser and the Thunderbird email client, which allows a hacker to trigger a service failure

The vulnerability of the WebAssembly component in the Firefox web browser and the Thunderbird email client is related to type conversion errors. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

EEF-CVE-2026-39805 CL.CL HTTP request smuggling via duplicate Content-Length in bandit

Summary Inconsistent Interpretation of HTTP Requests vulnerability in mtrudel bandit allows HTTP request smuggling via duplicate Content-Length headers. 'Elixir.Bandit.Headers':get\content\length/1 in lib/bandit/headers.ex uses List.keyfind/3, which returns only the first matching header. When a...

PT-2026-36367

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Resource leaks occur in the gpiochip add data with key function. Due to gdev-dev.release being unset, the reference count to gdev-dev is not dropped during error handling paths...

CVE-2026-37554

An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworking packet processing pipeline where OpenSSL exceptions from ECC point validation invalid compressed point, point not on curve are not...