CVE-2026-66753 tiny-http 0.12.0 HTTP Response Splitting via Header Injection

tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return 0x0D and line feed 0x0A bytes into HTTP header values on both request and response sides due to insufficient validation in header parsing and serialization. Attackers can explo...

PT-2026-65523

tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return 0x0D and line feed 0x0A bytes into HTTP header values on both request and response sides due to insufficient validation in header parsing and serialization. Attackers can explo...

PT-2026-65517

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...

CVE-2026-59900

A flaw was found in Netty's netty-codec-http2 component. The HTTP/2 encoder does not properly handle special characters in HTTP headers. This vulnerability allows a remote attacker to craft specific HTTP/2 requests, leading to HTTP response splitting and header injection attacks. Such attacks can...

Ruby on Rails - Open Redirect via Host Header Injection

Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers. id: CVE-2021-22881 info: name: Ru...

GHSA-46Q4-43PH-C6FR blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names/values e.g. X-Forwarded-For, internal-auth headers that a fronting proxy sanitized from the...

EUVD-2026-48728

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes RHACM and multicluster-engine MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke...

CVE-2026-17107 Cluster-proxy: cluster-proxy: impersonation header injection in service-proxy grants cluster-admin on every managed cluster

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes RHACM and multicluster-engine MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke...

CVE-2026-65601

A flaw was found in Traefik, a cloud-native edge router. A low-privileged user in a Kubernetes environment could exploit a namespace confusion vulnerability within the Kubernetes Gateway API provider. This flaw allows an attacker to bypass security controls by incorrectly binding a Traefik...

SUSE-SU-2026:3207-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues - CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service bsc1261320. - CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of...

EUVD-2026-48242

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

CVE-2026-65606 SiYuan before v3.7.2 Cross-Site Scripting to RCE

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

GHSA-GCJF-9MGH-3P7G Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-http multipart | | Component |...

GHSA-3G8R-4PFX-JMFH Netty: STOMP CONNECT Frame Header Injection in Netty

Security Vulnerability Report: STOMP CONNECT Frame Header Injection in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-stomp | | Component | io.netty.handler.codec.stomp.StompSubframeEncoder | |...

Netty: STOMP CONNECT Frame Header Injection in Netty

Security Vulnerability Report: STOMP CONNECT Frame Header Injection in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-stomp | | Component | io.netty.handler.codec.stomp.StompSubframeEncoder | |...

EUVD-2026-47645

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules.backendRefs.filters.extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route auth...

CVE-2026-65601 Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules.backendRefs.filters.extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route auth...

CVE-2026-65601 Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules.backendRefs.filters.extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route auth...

PT-2026-63551

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description Netty's STOMP encoder StompSubframeEncoder fails to escape or validate header values in CONNECT and CONNECTED frames. This occurs because the encoder...

Plone 3.3.x < 4.3.7 Multiple Vulnerabilities (HF 20150910)

The version of Plone installed on the remote host is 3.3.x prior to 4.3.7. It is, therefore, affected by the following vulnerabilities: - Plone allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator CVE-2015-7315 -...