CVE-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-48932

A flaw in the Node.js HTTP client can cause request desynchronization in Node.js-based forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while piping the original body to a reused backend connection. The root cause is that Node.js may omit headers beyond maxHea...

EUVD-2026-68923

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

PT-2026-84257

Name of the Vulnerable Software and Affected Versions OTP versions 17.0 through 27.3.4.16 OTP versions 28.0 through 28.5.0.5 OTP versions 29.0 through 29.0.5 inets versions 5.10 through 9.3.2.6 inets versions 9.4 through 9.6.2.2 inets versions 9.7 through 9.7.1 Description httpd does not implemen...

CVE-2026-84479: Authentication Bypass by Spoofing

WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...

CVE-2026-84640: Buffer Over-read

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

CVE-2026-73524: Improper Neutralization of Input During Web Page Generation

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-63435: Interpretation Conflict

Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.qvaluedecode and Mail::Utilities.bvaluedecode used a single Stringmatch and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle...

PT-2026-84072

Name of the Vulnerable Software and Affected Versions Node.js version 22 Node.js version 24 Node.js version 26 Description A flaw in the HTTP client can cause request desynchronization for forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the...

PT-2026-84538

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions e01e41ecc and earlier Description Three security controls during the login process rely exclusively on the client-supplied User-Agent header. The functions isAVideoEncoder and isAVideoMobileApp compare the HTTP USER AGENT...

PT-2026-84296

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-'...

PT-2026-84460

Name of the Vulnerable Software and Affected Versions Mail versions prior to 2.9.1 Description Mail is an internet library for Ruby used for email generation, parsing, and sending. The functions q value decode and b value decode within Mail::Utilities use a single Stringmatch and an overly greedy...

PT-2026-84376

Name of the Vulnerable Software and Affected Versions gRPC-Go versions prior to 1.83.1 Description The xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go fails to lowercase header matcher names within the normalizeHeaderMatcher function, despite incoming metadata keys being lowercase...

Erlang/OTP -- multiple vulnerabilities in inets, stdlib, snmp and eldap

The Erlang/OTP project reports: OTP 29.0.6, 28.5.0.6 and 27.3.4.17 fix the following issues, most of them in the inets httpd and httpc implementations: CVE-2026-55951: httpc Memory Exhaustion via Unbounded Header Accumulation. CVE-2026-59696: stdlib: Denial-of-Service enabled by Unbounded Integer...

TencentOS Server 4: nodejs20 (TSSA-2026:0949)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0949 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

PT-2026-84466

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-66357: Inconsistent Interpretation of HTTP Requests

httpd has never implemented obs-fold RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue...

openSUSE 16 Security Update : python-h2 (openSUSE-SU-2026:21693-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21693-1 advisory. This update for python-h2 fixes the following issue: - CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, whic...

PT-2026-84526

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 140.15 Thunderbird versions prior to 153.2 Thunderbird versions prior to 155 Description A maliciously constructed mail header can cause a one byte read past the end of a buffer, which is a memory safety issue whe...