Linux Distros Unpatched Vulnerability : CVE-2026-66753

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return 0x0D and line feed 0x0A bytes into HTTP...

📄 rouille 3.6.2 HTTP Response Splitting

rouille versions 3.6.2 and earlier contain an HTTP response splitting vulnerability due to improper validation of response header values. Applications that place attacker-controlled data into HTTP response headers can inject carriage return and line feed characters, allowing attackers to create...

ALSA-2026:48225 Important: perl:5.32 security update

Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fixes: perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size CVE-2026-9538 For more details about the security issues,...

PT-2026-65915

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...

Linux Distros Unpatched Vulnerability : CVE-2026-33930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflo...

Linux Distros Unpatched Vulnerability : CVE-2026-67181

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting...

PT-2026-65720

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through...

Linux Distros Unpatched Vulnerability : CVE-2026-58184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Apache Traffic Server headerrewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traff...

UBUNTU-CVE-2026-66753

tiny-http through 0.12.0 contains an HTTP header injection vulnerabili...

PT-2026-65892

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.6 Description The llm.chat function reads provider keys, such as OPENAI API KEY and ANTHROPIC API KEY, from the environment and transmits them within the Authorization: Bearer header to a base url controlled ...

PT-2026-65761

The Apache Traffic Server header rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version...

RockyLinux 8 : nodejs:22 (RLSA-2026:47059)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47059 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed tar...

Linux Distros Unpatched Vulnerability : CVE-2026-59919

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder...

ALSA-2026:48034 Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

ALSA-2026:48033 Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed...

DEBIAN-CVE-2026-59921

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without...

CVE-2026-59921

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without...

CVE-2026-59921

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without...

datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

Summary When datamodel-code-generator fetches a remote schema and follows an HTTP redirect, it re-sends the original request headers, including any Authorization header, to the redirect target even when the redirect changes origin host/port/scheme. Credentials that an operator scoped to a trusted...

GHSA-R5VV-FF45-PRP2 datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

Summary When datamodel-code-generator fetches a remote schema and follows an HTTP redirect, it re-sends the original request headers, including any Authorization header, to the redirect target even when the redirect changes origin host/port/scheme. Credentials that an operator scoped to a trusted...