ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +31181 more potentially affected by CVE-2025-67735 +1 more via io.netty:netty-handler-proxy (>=4.1.0.beta4, <=4.1.132.final)

io.netty:netty-handler-proxy MAVEN version =4.1.0.beta4, =0.0.1, =1.0.0, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.3, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +31181 more potentially affected by CVE-2025-67735 +1 more via io.netty:netty-handler-proxy (>=4.1.0.beta4, <=4.1.132.final)

io.netty:netty-handler-proxy MAVEN version =4.1.0.beta4, =0.0.1, =1.0.0, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.3, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)

Security Vulnerability Report: HTTP Header Injection via HttpProxyHandler Disabled Validation in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions | | Component | io.netty.handler.proxy.HttpProxyHandler | |...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +31181 more potentially affected by CVE-2025-67735 +1 more via io.netty:netty-handler-proxy (>=4.1.0.beta4, <=4.1.132.final)

io.netty:netty-handler-proxy MAVEN version =4.1.0.beta4, =0.0.1, =1.0.0, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.3, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0) +3524 more potentially affected by CVE-2025-67735 +1 more via io.netty:netty-handler-proxy (>=4.2.0.alpha1, <=4.2.12.final)

io.netty:netty-handler-proxy MAVEN version =4.2.0.alpha1, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2025-67735, CVE-2026-42578 Source advisory: OSV:GHSA-45Q3-82M4-75JR...

GHSA-45Q3-82M4-75JR Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)

Security Vulnerability Report: HTTP Header Injection via HttpProxyHandler Disabled Validation in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions | | Component | io.netty.handler.proxy.HttpProxyHandler | |...

PT-2026-41601

Summary Access tokens created with the "never expire" option have no exp JWT claim. Three independent revocation mechanisms fail for this token type. Logout at internal/handler/auth/auth.go:154 and :163 dereferences claims.ExpiresAt.Time, panicking on the nil field so the token never hits the...

PT-2026-38555

Name of the Vulnerable Software and Affected Versions OSGeo gdal versions prior to 3.13.0RC1 Description An issue exists in the HDF-EOS Grid File Handler component within the memmove function of the frmts/hdf4/hdf-eos/SWapi.c file. This flaw allows for an out-of-bounds read, which occurs when the...

CVE-2026-8114: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in JeecgBoot up to 3.9.1. Affected by this issue is some unknown functionality of the file /sys/dict/loadTreeData of the component JSON Object Handler. The manipulation of the argument condition leads to sql injection. The attack can be initiated remotely. The explo...

Linux Distros Unpatched Vulnerability : CVE-2026-43192

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: dm mpath: Add missing dmputdevice when failing to get scsi dh name When commit fd81bc5cca8f...

CVE-2026-8084: Out-of-bounds Read

A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit...

Inngest-js information leakage vulnerability

Inngest-js is an open-source framework developed by Inngest, designed to support various serverless platforms. It serves as a reliable event-driven and background task execution framework. Versions 3.22.0 to 3.53.1 of Inngest-js contain a vulnerability related to information leakage. This...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32569)

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics Corporation. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from the function setUrlFilterRules in the CGI Handler component’s file /cgi-bin/cstecgi.cgi,...

PT-2026-38412

Name of the Vulnerable Software and Affected Versions Docling-Graph versions prior to 1.5.1 Description The URLInputHandler class in docling graph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating if the target resolves to a private, loopback, or link-local IP...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32570)

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from the function setWiFiWpsStart in the CGI Handler component’s file /cgi-bin/cstecgi.cgi. This function...

CVE-2026-42047: Exposure of Sensitive Information to an Unauthorized Actor

Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orchestration. Versions 3.22.0 through 3.53.1 contain a vulnerability that allows unauthenticated remote attackers to exfiltrate environment variables from the host process via the...

Linux Distros Unpatched Vulnerability : CVE-2026-8084

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the...

Flight vulnerable to sensitive information disclosure via default error handler

Summary The default error handler Engine::error writes the full exception message, exception code, and stack trace including absolute filesystem paths directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception...

GHSA-QRCH-52M5-VV85 Flight vulnerable to sensitive information disclosure via default error handler

Summary The default error handler Engine::error writes the full exception message, exception code, and stack trace including absolute filesystem paths directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception...

EUVD-2026-28206

A vulnerability has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. This affects an unknown function of the file /cdemos/echs/api/v2/ of the component Response Header Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The exploit ha...