EUVD-2026-83287

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

CVE-2026-93750

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the varyMatches function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intende...

DEBIAN-CVE-2026-93750

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the varyMatches function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intende...

AZL-103487 CVE-2026-93750 affecting package python-tensorboard 2.16.2-6

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the varyMatches function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intende...

AZL-103451 CVE-2026-93750 affecting package nodejs-nodemon 2.0.3-5

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the varyMatches function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intende...

CVE-2026-81179

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWEDHOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request...

CVE-2026-65979

A flaw was found in OpenEXR's HTJ2K decoder. A local user could be tricked into opening a specially crafted EXR image file. When processed, the decoder reads beyond the bounds of an allocated buffer due to an unvalidated header length field. This out-of-bounds read can lead to a denial of service...

EUVD-2026-83255

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the varyMatches function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intende...

EUVD-2026-83249

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWEDHOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request...

CVE-2026-81179

SysReptor is a pentest reporting platform vulnerable to Host header injection prior to version 2026.58 . When password reset by email is enabled and ALLOWED_HOSTS is configured with a wildcard, an unauthenticated attacker can request a reset email whose link points to an attacker-controlled syste...

CVE-2026-81179 SysReptor: Host header injection might allow account takeover

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWEDHOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request...

CVE-2026-81179 SysReptor: Host header injection might allow account takeover

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWEDHOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request...

CVE-2026-81179 SysReptor: Host header injection might allow account takeover

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWEDHOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request...

CVE-2026-61666

A flaw was found in websocket-driver. A remote attacker can exploit this vulnerability by sending a malformed Host header that does not conform to a valid host:port string. This action triggers an uncaught exception, leading to a Denial of Service DoS by crashing the WebSocket server and making i...

CVE-2026-69186

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsparse trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because processanswer invokes parsing before transaction ID and...

DEBIAN-CVE-2026-93579

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

CVE-2026-93579

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

CVE-2026-77606

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable...

UBUNTU-CVE-2026-93579

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

CVE-2026-93579

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...