CVE-2026-109793: SAP_SE SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher: SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values…

SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values processed during inbound request handling. An unauthenticated attacker could send a specially crafted request to cause the affected process to become unavailable.This results in a high...

CVE-2026-117477: GMO Prime Strategy Co., Ltd.: KUSANAGI provided by GMO Prime Strategy Co., Ltd

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL...

CVE-2026-112137: Siemens: A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro…

A vulnerability has been identified in Mendix Studio Pro 11 All versions = V11.15.0 = V11.12.6 V11.12.7. The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery CSRF. This could allo...

PT-2026-141592

DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="" with the name inserted verbatim, so a double quote in the name ends the quoted string...

CVE-2026-92441: Kong Inc.: Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the…

Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-151139)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151139 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at t...

Fedora 44 : perl-CGI (2026-516e427bac)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-516e427bac advisory. 5.02 bump - Fix CVE-2026-120631 CGI::Cookie-parse backtracking DoS via cookie expires regex - Fix CVE-2026-120632 cubic regex backtracking via craft...

PT-2026-143632

Name of the Vulnerable Software and Affected Versions ASP.NET Core versions 8.0.0-preview.1.23112.2 through 8.0.33 ASP.NET Core versions 9.0.0-preview.1.24081.5 through 9.0.22 ASP.NET Core versions 10.0.0-preview.1.25120.3 through 10.0.14 ASP.NET Core versions 11.0.0-preview.1.26104.118 through...

CVE-2026-120326: vaadin: DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header…

DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename=" " with the name inserted verbatim, so a double quote in the name ends the quoted strin...

PT-2026-144759

Name of the Vulnerable Software and Affected Versions Action Pack versions 8.1 through 8.1.4 Description ActionDispatch::RemoteIp derives request.remote ip from Rack::Requestforwarded for, which under Rack 3 prioritizes the RFC 7239 Forwarded header over X-Forwarded-For. If a reverse proxy append...

RHEL 9 : rhc (RHSA-2026:97699)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:97699 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fixes: mim...

Linux Distros Unpatched Vulnerability : CVE-2026-125108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parseboundary can skip a leading empty or quoted bounda...

PT-2026-141242

SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values processed during inbound request handling. An unauthenticated attacker could send a specially crafted request to cause the affected process to become unavailable.This results in a high...

PT-2026-144831

Name of the Vulnerable Software and Affected Versions Kong Gateway Enterprise affected versions not specified Kong AI Gateway affected versions not specified Description Kong Gateway Enterprise and Kong AI Gateway include decoded Carriage Return CR and Line Feed LF characters from the request pat...

UBUNTU-CVE-2026-125246

FFmpeg through 9.0.2 contains a denial of service vulnerability in cbsjpegassemblefragment that miscounts 0xff stuffing bytes in JPEG scan headers. Attackers can supply a crafted JPEG/MJPEG stream with 0xff in the scan header, triggering an avassert0 abort when CBS-based bitstream filters process...

Fedora 45 : perl-CGI (2026-a04615c725)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a04615c725 advisory. 5.02 bump - Fix CVE-2026-120631 CGI::Cookie-parse backtracking DoS via cookie expires regex - Fix CVE-2026-120632 cubic regex backtracking via craft...

CVE-2026-114149

Multipart form processing can bypass the configured header-count limit and consume excessive resources...

PT-2026-141591

A vulnerability has been identified in Mendix Studio Pro 11 All versions = V11.15.0 = V11.12.6 V11.12.7. The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery CSRF. This could allo...

CVE-2026-126083: rails: Action Pack is a framework for handling and responding to web requests

Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remoteip from Rack::Requestforwardedfor, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-151168)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151168 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksumstart before completing checksum If a packet with bad checksum metadata ge...