Linux Distros Unpatched Vulnerability : CVE-2026-107228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the...

EulerOS 2.0 SP15 : mod_http2 (EulerOS-SA-2026-3992)

According to the versions of the modhttp2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

EUVD-2026-92754

Ghost: Server-Side Request Forgery in Bookmark Fetching...

EUVD-2026-92755

Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses...

GHSA-R7F2-6FJ8-6FG2 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned...

CVE-2026-39724

Unauthenticated Cross Site Scripting XSS in HTTP Requests Manager = 1.3.11 versions...

CVE-2026-39724 WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in HTTP Requests Manager = 1.3.11 versions...

CVE-2026-39724 WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in HTTP Requests Manager = 1.3.11 versions...

EUVD-2026-93246

Unauthenticated Cross Site Scripting XSS in HTTP Requests Manager = 1.3.11 versions...

CVE-2026-39724

The WordPress HTTP Requests Manager plugin, affecting versions

EUVD-2026-92873

There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints...

CVE-2026-39724: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in HTTP Requests Manager = 1.3.11 versions...

PT-2026-106411

Unauthenticated Cross Site Scripting XSS in HTTP Requests Manager = 1.3.11 versions...

CVE-2026-82989 CVE-2026-82989

There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints...

CVE-2026-82989

ViewSonic ViewBoard smartboards, which run on an Android-based system, are vulnerable to an input injection flaw in the vCast software suite. The vulnerability exists in exposed network services, allowing a remote, unauthenticated attacker to inject arbitrary input into service endpoints via HTTP...

CVE-2026-105647

Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

CVE-2026-105648

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

CVE-2026-105648 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

CVE-2026-105648 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

CVE-2026-105648

The Ghost Node.js content management system is vulnerable to a validation issue in versions 6.0.9 through 6.65.0 . An unauthenticated user can abuse certain functionalities, such as Webmentions , to perform limited HTTP requests to hosts within the server's internal network on specific network co...