PT-2026-137442

Name of the Vulnerable Software and Affected Versions Apache Juneau versions prior to 9.2.1 Description Improper Neutralization of CRLF Sequences in HTTP Headers, also known as HTTP Response Splitting, occurs when the REST server passes response header values and redirect targets to the servlet...

PT-2026-137440

Name of the Vulnerable Software and Affected Versions Apache Juneau versions prior to 9.2.1 Description An information disclosure issue exists where the REST server sends the internal exception class and message to clients via a "Thrown" response header during every error response. Additionally,...

Linux Distros Unpatched Vulnerability : CVE-2026-63183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host...

UBUNTU-CVE-2026-63183

OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed fullhost nor framework-level incoming host validation is configured. A remote unauthenticated client can...

CVE-2026-63183

OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed fullhost nor framework-level incoming host validation is configured. A remote unauthenticated client can...

CVE-2026-122299

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default fo...

CVE-2026-122299 Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default fo...

CVE-2026-122299 Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default fo...

CVE-2026-122299

The Dulwich library (versions before 1.2.20 ) contains a commit object parsing vulnerability in the _parse_commit read path. The flaw allows the parser to resolve duplicate tree headers to the last occurrence instead of the first, which deviates from standard core git behavior. This inconsistency...

[SECURITY] [DSA 6612-1] symfony security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6612-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 04, 2026 https://www.debian.org/security/faq -...

CVE-2026-12538

IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields...

DEBIAN-CVE-2026-122132

go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301...

CVE-2026-122132

go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301...

CVE-2026-105991

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing Content Security Policy header...

CVE-2026-105991

IBM Db2 Genius Hub versions 1.1.2, 1.1.3, 1.1.4, and 1.1.5 are affected by a processing logic error vulnerability. The root cause is the absence of a Content Security Policy (CSP) header , which could allow a remote authenticated attacker to bypass security restrictions . While the CVSS3.1 score ...

EUVD-2026-117112

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing Content Security Policy header...

CVE-2026-105991 Multiple vulnerabilities that affects IBM Db2 Genius Hub

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing Content Security Policy header...

EUVD-2026-117086

go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301...

CVE-2026-12538

IBM MQ Appliance is affected by an improper validation vulnerability (tracked as CWE-124: Buffer Underwrite ) involving message header structure length fields. An authenticated attacker could leverage this to obtain sensitive information or cause a denial of service . Affected versions include 9....

EUVD-2026-117072

IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields...