CVE-2026-63292

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

UBUNTU-CVE-2026-63292

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

CVE-2026-63292

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

CVE-2026-21833 HCL AION is susceptible to a Missing "Content-Security-Policy" header Vulnerability (CVE-2026-21833)

HCL AION is affected by a vulnerability in which the Content-Security-Policy CSP HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting XSS by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header...

EUVD-2026-90966

HCL AION is affected by a vulnerability in which the Content-Security-Policy CSP HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting XSS by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header...

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

Packagepyjwt PyPI Affected versionstested & verified on: 2.13.0. Every version whose PyJWS.load translates only ValueError is affected DescriptionPyJWS.looad jwt/apijws.py:337 splits the compact token, base64url decodes the header segment and hands it to json.loads before verifysignature runs. Th...

PyJWT: PyJWKClient follows redirects when fetching JWKS

SummaryPyJWT 2.13.0 PyJWKClient followed HTTP redirects while fetching a JWKS,without validating the redirect destination. A configured trusted endpointcould therefore redirect the client to a different host. ImpactWhen an application uses PyJWKClient with caller-supplied request headers andan...

PYSEC-2026-4144 PyJWT: PyJWKClient follows redirects when fetching JWKS

Summary PyJWT 2.13.0 PyJWKClient followed HTTP redirects while fetching a JWKS, without validating the redirect destination. A configured trusted endpoint could therefore redirect the client to a different host. Impact When an application uses PyJWKClient with caller-supplied request headers and ...

PYSEC-2026-4083 MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow

Summary The SSRF protection for header-based authentication uses a validate-then-use pattern vulnerable to DNS rebinding. validateurlforssrf resolves the hostname via DNS and checks that the resolved IP is globally routable. However, the actual HTTP request happens later, during which the DNS...

MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow

SummaryThe SSRF protection for header-based authentication uses a validate-then-use pattern vulnerable to DNS rebinding. validateurlforssrf resolves the hostname via DNS and checks that the resolved IP is globally routable. However, the actual HTTP request happens later, during which the DNS reco...

Jupyter Server: 5xx request logging leaks token-bearing Referer header values

SummaryWhen a request returns a 500, jupyterserver/log.py logs a small JSON block of request headers. The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text. ImpactAnyone who can read the server logs can pick tokens out of these 500 entries...

PYSEC-2026-4054 Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Summary When a request returns a 500, jupyterserver/log.py logs a small JSON block of request headers. The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text. Impact Anyone who can read the server logs can pick tokens out of these 500 entries...

CVE-2026-101322

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

PHP-8.1.0-dev-Backdoor

PHP 8.1.0-dev User-Agentt Backdoor Remote Code Execution RCE Severity: Critical CVSS Equivalent: 10.0 Vulnerability Type: Supply Chain Backdoor / Remote Code Execution RCE Affected Software: PHP 8.1.0-dev Development Build Only Attack Vector: Remote Unauthenticated Authentication Required: No Use...

EUVD-2026-90902

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

CVE-2026-63292

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

CVE-2026-63292 Apache HTTP Server: mod_vhost_alias stack overflow

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

CVE-2026-63292 Apache HTTP Server: mod_vhost_alias stack overflow

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

CVE-2026-63292

A stack-based buffer overflow exists in mod_vhost_alias within the Apache Software Foundation Apache HTTP Server (versions through 2.4.68). An attacker can trigger this by sending an HTTP request with a Host header exceeding 8192 bytes, provided that VirtualDocumentRoot uses a hostname format spe...

EUVD-2026-90890

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...