CVE-2026-92414

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...

CVE-2026-107228

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contribut...

PT-2026-108313

Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description Excessive CPU consumption occurs when parsing a Range header that contains a large number of small ranges. This issue affects the FileServerFS, ServeContent, and ServeFileFS functions...

DEBIAN-CVE-2026-107282

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...

CVE-2026-107282

Removed by vendor...

CVE-2026-107228

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contribut...

CVE-2026-107228 AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contribut...

CVE-2026-107228

The AsyncHttpClient (AHC) library versions 2.1.0 through 3.0.14 contains a vulnerability where the default cookie store silently overrides explicit Cookie headers provided via setHeader or addHeader. In shared client environments, this allows cookies from one user's session to replace another use...

CVE-2025-12543-Fix-for-Wildfly

WildFly 11.0.0.Final बेस इमेज — CVE-2025-12543 पैच अवलोकन यह रिपॉजिटरी एक Docker बेस इमेज प्रदान करती है जो WildFly 11.0.0.Final पर बनाई गई है, जिसमें CVE-2025-12543 के लिए एक बैकपोर्टेड फिक्स है, जो Undertow में एक महत्वपूर्ण Host हेडर वैलिडेशन भेद्यता है। यह इमेज सहकर्मियों को बेस के रूप में...

Security Bulletin:WebOb Open Redirect Vulnerability in HTTP Location Header Normalization

Summary WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying...

Security Bulletin:Axios Node.js HTTP Adapter Proxy Credential Leakage Vulnerability in 0.32.0 and 1.16.0

Summary Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios' Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header...

SUSE-SU-2026:4570-1 Security update for the Linux Kernel (Live Patch 84 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.317 fixes various security issues: The following security issues were fixed: - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsithandletextcmd bsc1272391. - CVE-2026-63920: ipv6: validate extension header...

CVE-2026-92414

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...

CVE-2026-92414

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...

cve-2025-25257

CVE-2025-25257 - प्रयोग वातावरण प्रयोग की वास्तुकला वातावरण FortiWeb के कमजोर घटकों का अनुकरण करता है कमजोर एंडपॉइंट: /api/system/fabric/config इंजेक्शन वेक्टर: HTTP हेडर Authorization: Bearer तंत्र: प्रत्यक्ष SQL संयोजन Python f-string प्रमाणीकरण: कोई नहीं पूर्ण बाईपास डेटाबेस: SQLite प्रदर्शन क...

GO-2026-6639 Anubis: Policy bypass via client controlled X-Original-URI header in github.com/TecharoHQ/anubis

Anubis: Policy bypass via client controlled X-Original-URI header in github.com/TecharoHQ/anubis...

CVE-2026-20896

प्रूफ ऑफ कॉन्सेप्ट कोड CVE-2026-20896 यह स्क्रिप्ट Gitea API के रूट वैलिडेशन में तार्किक दोष का शोषण स्वचालित करती है, जिससे प्राधिकरण हेडर में डायरेक्टरी ट्रैवर्सल हमले के माध्यम से सर्वर को एक मान्य प्रशासनिक टोकन प्रदान करने के लिए मजबूर किया जा सकता है। !/usr/bin/env python3 PoC: Gitea...

CVE-2026-107159 MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header

MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and...

CVE-2025-29927__Next.js

CVE-2025-29927 - POC لتجاوز التفويض في Next.js Middleware ⚠️ إخلاء مسؤولية قانونية : هذه الأداة مخصصة فقط لأغراض البحث الأمني واختبار الاختراق المصرح به والتعليم. استخدام هذه الأداة على أنظمة مستهدفة دون إذن صريح هو غير قانوني وغير أخلاقي. 📋 نظرة عامة CVE-2025-29927 هو ثغرة أمنية حرجة في Next.js...

SmartAsset-CORS-CVE-2020-26527

SmartAsset-CORS-CVE-2020-26527 CVE-2020-26527 Smart Asset - संस्करण 2020.7 Damstra Smart Asset 2020.7 के API/api/Version में एक समस्या पाई गई थी। क्रॉस-ऑरिजिन रिसोर्स शेयरिंग CORS मनमाने ऑरिजिन पर भरोसा करता है, जो 'Origin: example.com' हेडर को स्वीकार करता है और 200 OK और वाइल्डकार्ड...