Qlik Sense Enterprise - HTTP Request Smuggling

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunnelin...

Citrix SD-WAN Center - Remote Command Injection

Citrix SD-WAN Center is susceptible to remote command injection via the apply action in StorageMgmtController. The callStoragePerl function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerabili...

SUSE SLED15 / SLES15 Security Update : libsoup (SUSE-SU-2026:5062-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:5062-1 advisory. This update for libsoup fixes the following issue: - CVE-2026-103399: incomplete request body draining in HTTP/1.x earl...

SUSE SLES15 Security Update : libsoup (SUSE-SU-2026:5063-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:5063-1 advisory. This update for libsoup fixes the following issue: - CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow...

CVE-2026-103866: Apache Software Foundation Apache Sling Engine: Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine

Inconsistent interpretation of HTTP requests 'HTTP Request/Response smuggling' vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before...

Linux Distros Unpatched Vulnerability : CVE-2026-121727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sendi...

CVE-2026-63655

The tsParticles TypeScript library (specifically the @tsparticles/mcp-server component) is vulnerable to a Denial of Service (DoS) attack in versions prior to 4.3.1 . The vulnerability exists because the HTTP mode accepts unauthenticated POST /mcp requests and accumulates request-body chunks into...

CVE-2026-63655 tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer without a...

CVE-2026-63655 tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer without a...

SUSE CVE-2026-110944

Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server...

CVE-2026-76506

A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied...

EUVD-2026-116971

A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied...

CVE-2026-76506 Cisco Unified Computing System Central Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied...

CVE-2026-76506

A vulnerability in the Cisco UCS Central Software web-based management interface allows an authenticated, remote attacker to achieve remote code execution or perform information disclosure . The root cause is insufficient validation of user-supplied input in an HTTP request. A successful exploit ...

CVE-2026-76506 Cisco Unified Computing System Central Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied...

CVE-2026-110944

Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server...

CVE-2026-110944

A resource exhaustion vulnerability exists in the HTTP request handling of the QHttpServer component within Qt HTTP Server . The issue is caused by the allocation of resources without limits or throttling (CWE-770). This vulnerability can impact the availability of the affected service. No specif...

EUVD-2026-116718

The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks...

EUVD-2026-116585

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...

CVE-2026-120637

A flaw was found in perl-cgi. When processing an unrecognized HTTP request method, such as OPTIONS, the module unintentionally falls back into its default offline debugging mode. A remote attacker can exploit this issue by submitting a request with an unhandled method to force the application to...