AZL-97566 CVE-2026-63385 affecting package ntp for versions less than 4.2.8p17-3

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass...

AZL-96947 CVE-2026-63385 affecting package libevent for versions less than 2.1.13-1

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass...

CVE-2026-63385

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass...

CVE-2026-63385 Libevent: HTTP header handling bugs create risk of access control bypass.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass...

CVE-2026-63385 Libevent: HTTP header handling bugs create risk of access control bypass.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass...

CVE-2026-73257 Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The clcount and tecount checks in the mghttpparse and httpcb paths in src/http.c accept both...

EUVD-2026-60573

Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cowlink:link/1. cowlink:dolink/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header valu...

GHSA-FM65-XRRR-C358 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

CVE-2026-28753 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

GHSA-82W2-X7HF-5H8R vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

GHSA-HWQ5-42J9-JVQJ vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

CVE-2026-42926 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

CVE-2026-42530 vulnerabilities

Vulnerabilities for packages: nginx-mainline...

GHSA-VXCV-H5WJ-JXR5 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

GHSA-M73P-XG7Q-M8F2 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

CVE-2026-32647 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

CVE-2026-40701 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

GHSA-Q83H-524G-XF6H

creationtimestamp| type| source ---|---|--- 2026-08-17 16:33:14+00:00| seen| https://bsky.app/profile/seanmonstar.com/post/3mtc4wzyp3z2l...

PT-2026-73265

Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...

DEBIAN-CVE-2026-74468

In the Linux kernel, the following vulnerability has been resolved: gpio: pch: use rawspinlockt for the register lock pchirqtype is registered as the irqchip .irqsettype callback and takes chip-spinlock with spinlockirqsave. This callback is reached from setupirq - irqsettrigger - chip-irqsettype...