CVE-2026-127088

2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over...

ExponentCMS <= 2.6 - Host Header Injection

An HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponentconstants.php. A modified HTTP header can change links on the webpage to an arbitrary value,leading to a possible attack vector for MITM. id: CVE-2021-38751 info: name: ExponentCMS = 2.6 - Host Header Injection author:...

CVE-2026-66981

HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended...

CVE-2026-66981 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended...

EUVD-2026-118311

HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended...

CVE-2026-66981

HCL AION is affected by a security vulnerability where the application trusts the value of the HTTP Host header in requests without proper validation. An attacker could manipulate this header to influence redirects, links, or the responses generated by the application, potentially leading to unin...

CVE-2026-66981 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended...

CVE-2026-66981: HCL Software HCL AION: HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in…

HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended...

Linux Distros Unpatched Vulnerability : CVE-2026-119760

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolvcancel that allows remote unauthenticated attackers to crash the daemon by...

CVE-2026-119760

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolvcancel that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then clo...

DEBIAN-CVE-2026-119760

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolvcancel that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then clo...

EUVD-2026-114237

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolvcancel that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then clo...

PT-2026-133709

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv cancel that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in starlette (CVE-2026-48710)

Summary An HTTP Host header path bypass vulnerability in the starlette package CVE-2026-48710 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 1.3.1 on both Linux and Windows operating systems in 11.7.0.15. Vulnerability Details...

Part-DB authorization issue vulnerability

Versions prior to Part-DB 2.13.3 contain an authorization issue vulnerability. This vulnerability arises when a password reset link is generated based on the HTTP Host header provided by the client without verifying its authenticity; as a result, unauthenticated attackers can forge the Host heade...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130123)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130123 advisory. Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through...

CVE-2026-87686

An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socke...

CVE-2026-87686

An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socke...

CVE-2026-87686

An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socke...

EUVD-2026-94670

An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socke...