CVE-2026-101908: Improperly Controlled Modification of Object Prototype Attributes

Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers...

PT-2026-99947

Name of the Vulnerable Software and Affected Versions Axios versions 1.0.0 through 1.19.x Description The dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. When a same-process prototype pollution flaw sets Object.prototype.headers and...

CVE-2026-101904: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trust...

CVE-2026-102296: Buffer Copy without Checking Size of Input

ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized stat...

CVE-2026-101900: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

CVE-2026-100659

A flaw was found in the Netty HTTP/3 codec. This vulnerability allows access control and request routing bypasses due to missing validation of destination headers. A remote, unauthenticated attacker can exploit this flaw by sending a Hypertext Transfer Protocol HTTP request containing conflicting...

CVE-2026-100659

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

CVE-2026-100642

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

CVE-2026-100659 Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

EUVD-2026-87736

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

CVE-2026-100642 SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

CVE-2026-100642 SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

PT-2026-99330

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final Description The HTTP/3 codec fails to enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field must carry the same value when both are...

CVE-2026-91766

A flaw was found in PHP. When following a redirect, the built-in HTTP Hypertext Transfer Protocol stream wrapper forwards sensitive request headers—such as authentication tokens and session cookies—unchanged, even when directed to a different host, port, or unencrypted connection. A malicious...

DEBIAN-CVE-2026-51773

An issue in the VMware datastore driver of OpenStack glancestore. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the retryrequest function fails to validate the destination host before attaching sensitive authentication headers...

UBUNTU-CVE-2026-51773

An issue in the VMware datastore driver of OpenStack glancestore. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the retryrequest function fails to validate the destination host before attaching sensitive authentication headers...

BIT-RCLONE-2026-79779 rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to...

CVE-2026-97731

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

EUVD-2026-86510

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

PT-2026-98823

Name of the Vulnerable Software and Affected Versions OpenStack Glance affected versions not specified Description A Server-Side Request Forgery SSRF issue exists in the Image API v2 of OpenStack Glance, specifically within the VMware datastore driver of glance store. When the show multiple...