Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP/2 header block handling. An attacker can cause excessive memory consumption by sending specially crafted HTTP/2 requests that bypass memory limits. Remediation A fix was...

CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

ALPINE-CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-56846

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

ALPINE-CVE-2026-56846

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

CVE-2026-56846

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

CVE-2026-56846

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

EUVD-2026-52563

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-58044

CVE-2026-58044 describes a flaw in the Node.js HTTP client that can cause request desynchronization for Node.js-based forwarding proxies. The problem arises because Node.js may omit headers beyond maxHeadersCount/maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, yet contin...

EUVD-2026-52564

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

Exploit for Improper Input Validation in Google Chrome

--- CVE-2026-11113 – SMTP Header Injection in Contact Form...

CSV Injection

Overview Affected versions of this package are vulnerable to CSV Injection via the visit export process. An attacker can cause arbitrary spreadsheet formulas to be embedded in exported CSV files by supplying specially crafted values in the User-Agent, Referer, or request path headers that begin...

ROS-20260804-73-0018

The vulnerability in the arch/parisc/include/asm/uaccess.h component of the Linux operating system’s kernel is related to insufficient comparison. Exploiting this vulnerability allows an attacker to compromise the confidentiality and integrity of the protected information...

CVE-2026-70552: Missing Authentication for Critical Function

MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any -ajax.php file in the codebase...

PT-2026-81479

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description OpenEXR, the reference implementation for the EXR image format, is subject to a crash when processing a specially crafted...

PT-2026-67840

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 109.6 Description An authentication bypass exists in the AJAX dispatcher. Unauthenticated attackers can access admin-gated endpoints by providing any X-Requested-With header and requesting a base64-encoded path th...

Amazon Linux 2023 : python3-tornado (ALAS2023-2026-2016)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2016 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving...