CVE-2026-82815

MegaEase EaseProbe (up to version 2.3.0) contains an improper access control flaw in the realIP function of web/server.go (Middleware component). An attacker can manipulate the X-Forwarded-For , X-Real-IP , or True-Client-IP headers to bypass access controls. The attack is remote , requires no pr...

CVE-2026-62309

A flaw was found in CoreDNS. A remote attacker can send a specially crafted 28-byte UDP datagram to a CoreDNS server with the proxyproto plugin enabled. This malformed datagram can cause the CoreDNS process to crash, leading to a denial of service DoS. The vulnerability arises from improper...

SUSE CVE-2026-72235

In the Linux kernel, the following vulnerability has been resolved: batman-adv: retrieve ethhdr after potential skb realloc on RX pskbmaypull in batadvinterfacerx could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-26449

A flaw was found in Stomper. A remote attacker can send a specially crafted message, specifically a SEND frame missing the destination header field, to the server. This action triggers a null pointer dereference, which is an attempt to access memory that does not exist, causing the server process...

CVE-2025-71405

A flaw was found in go-chi/chi. The RedirectSlashes middleware function incorrectly uses the Host header to build redirect URLs. A remote attacker can manipulate the Host header to redirect users to arbitrary malicious websites. This can lead to phishing attacks and credential theft. Mitigation...

CVE-2025-61163

A flaw was found in Cohere North AI. The server fails to properly validate the Origin header of incoming connection requests, leading to an excessively permissive cross-domain policy with untrusted domains. This vulnerability could allow an attacker to gain unauthorized access to sensitive...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

nodejs: Node.js: Request smuggling via HTTP client header truncation

A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application whi...

nodejs: Node.js: Request smuggling via HTTP client header truncation

A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application whi...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

CVE-2026-19880

A flaw was found in Logback-classic. This path-traversal vulnerability allows a remote attacker to create and append log files outside the intended directory. This occurs because an unsanitized discriminator value, influenced by the attacker for example, via an HTTP header, is used in a file path...

CVE-2026-80681

A flaw was found in the Linux kernel's vxlan component. A use-after-free vulnerability exists due to improper handling of the Ethernet header pointer after routeshortcircuit is called. When pskbmaypull reallocates the skb-head, the previously cached Ethernet header pointer becomes stale, leading ...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

CVE-2026-76984

Apache Wicket 's MetaDataHeaderItem class improperly escapes attribute values when generating and tags. The escape replaced " with \\", but a backslash before a double quote is meaningless in HTML, so an attacker-controlled value containing a double quote breaks out of the attribute and is pars...

CVE-2026-19651

A flaw was found in quarkus-spring-web. A remote attacker could exploit this vulnerability by manipulating the URL query string. The system incorrectly reads the URL query string as a request header, which can lead to an authorization bypass, allowing unauthorized access to resources. Mitigation...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

nodejs: Node.js: Request smuggling via HTTP client header truncation

A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application whi...

CVE-2026-74866

A flaw was found in @fastify/busboy, a Node.js multipart form-data parser. The parser incorrectly handles lone carriage return or line feed characters in multipart part headers, treating them as part of the filename or field name rather than as line breaks. A remote attacker could exploit this by...

CVE-2026-64607

A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...

CVE-2026-49853

A flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect to a different origin, the client improperly retains and forwards sensitive authentication credentials, such as Authorization headers, to the new, potentially untrusted, destination. This vulnerability allows a remote...