CVE-2026-72744 Nuxt before 4.5.1 Information Disclosure via Chrome DevTools

Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate isLocalDevRequest is header-based and trusts the...

RCE (Remote Code Execution) form-data Dependency in Bitbucket Data Center

This High severity RCE Remote Code Execution vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.5, 10.0.0, 10.1.1, 10.2.0, 10.3.0, and 10.4.1 of Bitbucket Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

Server-Side Request Forgery (SSRF)

Apache Camel is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper filtering of inbound WebSocket query and path parameters, allowing an attacker to inject Camel control headers such as CamelHttpUri, which can redirect server-side HTTP requests to...

CVE-2026-19519 Claircore: claircore: denial of service via unchecked type assertion in rpm header parser

A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of service...

EUVD-2026-55974

A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of service...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to the Iggy consumer copying externally controlled message headers directly into the Camel Exchange without filtering Camel control headers, which allows an attacker who can publish messages to a consumed Iggy...

CVE-2026-19516

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

Improper Input Validation

Apache Camel AWS SNS component is vulnerable to Improper Input Validation. The vulnerability is due to the absence of an inbound header-filtering rule in Sns2HeaderFilterStrategy, which could theoretically allow externally supplied message attributes to be mapped into Camel control headers;...

CVE-2026-67289

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit this vulnerability to inject arbitrary headers or requests into an HTTP proxy CONNECT request. This occurs because FreeRDP does not properly validate control characters in the server-controlled...

EUVD-2026-55938

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516 CVE-2026-19516 CVE Record

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

[SECURITY] [DSA 6429-1] caddy security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6429-1 [email protected] https://www.debian.org/security/ Aron Xu August 11, 2026 https://www.debian.org/security/faq -...

CVE-2026-66778

SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is...

CVE-2026-66778 Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is...

CVE-2026-66778 Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is...

CVE-2026-66778

CVE-2026-66778 affects SAP Approuter within SAP Business AI Platform. The vulnerability stems from insufficient sanitization of certain request headers forwarded to internal components, enabling an unauthenticated attacker to obtain limited unauthorized access to information (confidentiality impa...

EUVD-2026-55890

SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is...

CVE-2026-66776 Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful...

SUSE CVE-2026-42554

Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html on any request whose handler passes attacker-influenced data to the AutoFormat feature. The...

SUSE CVE-2026-52845

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forwardauth copyheaders deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through phpfastcgi, Caddy normalizes HTTP headers int...