PT-2026-137915

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.30.1 undici versions 8.0.0 through 8.12.3 Description The redirect interceptor fails to strip sensitive headers—including Authorization, Cookie, Proxy-Authorization, and Host—when a request is redirected to a...

CVE-2026-35115: HCL Software AION: HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or…

HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security HSTS header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or...

EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-4397)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to...

CVE-2026-66981: HCL Software HCL AION: HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in…

HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended...

PT-2026-138427

Name of the Vulnerable Software and Affected Versions 2FAuth versions prior to 8.0.0 Description When the AUTHENTICATION GUARD is set to reverse-proxy-guard, the ReverseProxyGuard::user function reads the default REMOTE USER identity header or a custom header defined by the AUTH PROXY HEADER FOR...

Linux Distros Unpatched Vulnerability : CVE-2026-55458

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in...

CVE-2026-21850: HCL Software HCL AION: HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without…

HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF characters. This may allow an attacker to inject headers or split responses, potentially resulting in unintended behavior or security impact under...

CVE-2026-116787

A flaw was found in FreeSWITCH. An unauthenticated attacker with network access to the event socket interface can cause a Denial of Service DoS by sending a message with a specially crafted Content-Length header. Because the header is processed prior to authentication, supplying negative or...

CVE-2026-92693 FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parserawpackettosimplepacketfull in src/simplepacketparserng.cpp dereferences ipv6extensionheaderfragmentt when IpProtocolNumberIPV6FRAG is present without first verifying that the eight-byte Fragment header...

CVE-2026-111769

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. Prior to 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/client, the HTTP client transports and OAuth client requests followed...

CVE-2026-55458

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion...

DEBIAN-CVE-2026-55458

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion...

kernel: ipv6: exthdrs: refresh nh after handling HAO option

A flaw was found in the Linux kernel's IPv6 extension header processing. When processing the Home Address Option HAO, the cached network header pointer may become invalid if the packet's memory is reallocated. This can lead to incorrect parsing of subsequent IPv6 Type-Length-Value TLV options,...

EUVD-2026-117782

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion...

CVE-2026-55458 Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion...

CVE-2026-32641

A flaw was found in Parseable, a log analytics platform. A remote unauthenticated attacker can exploit a vulnerability in the Kinesis header parsing middleware by sending specially crafted data in the x-amz-firehose-common-attributes header. This malicious input, such as non-UTF-8 data or malform...

CVE-2026-102984

A flaw was found in @astrojs/node. A remote attacker can cause a Denial of Service DoS by sending a specially crafted HTTP request containing a malformed port in the Host header. When static header handling is enabled, the adapter fails to catch the resulting URL parsing error, causing the Node...

CVE-2026-102479

A flaw was found in Eclipse Vert.x. The HTTP/1.x decoder improperly canonicalizes standard HTTP header names, causing malformed headers such as Content-Xength to be misinterpreted as Content-Length. A remote attacker can exploit this flaw by sending crafted HTTP requests to perform HTTP request...

CVE-2026-76181 Heap buffer overflow in dBASE index import

LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entri...

CVE-2026-116571

The FreeSWITCH telecom stack contains a stack buffer overflow in the mod_rtmp module, specifically within the rtmp_rtp2rtmpH264() function. The vulnerability occurs because the software copies wire-derived SPS and PPS values into a fixed stack buffer without verifying that the sizes and framing f...