AlmaLinux 9 : golang (ALSA-2026:86196)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:86196 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple...

Vulnerability related to improper handling of Apache bRPC

Versions of Apache bRPC prior to 1.18.0 contain a logic error vulnerability stemming from an interpretation conflict in the HTTP protocol implementation. The method dispatch function FindMethodPropertyByURI utilizes a string splitter that skips empty fields to segment request paths; this causes...

PT-2026-120701

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager affected versions not specified Cisco Unified Communications Manager Session Management Edition affected versions not specified Description An issue exists where improper input validation for specific HTTP...

PT-2026-120528

Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK...

hMailServer resource management error vulnerability

Versions 6.0.0 through 6.3.6 of hMailServer contain a resource management error vulnerability. This vulnerability stems from insufficient resources in the ACME HTTP-01 challenge responder pool; it processes only one connection at a time and waits up to 5 seconds for requests. Unauthenticated remo...

PT-2026-120531

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...

camel-netty-http Apache Camel Bypass Security

The vulnerability of the camel-netty-http component of the Apache Camel framework is related to deficiencies in the mechanism for handling registry-dependent data. Exploiting this vulnerability could allow a malicious actor to bypass existing security measures remotely...

Oracle HTTP Server 12c (October 2026 CPU)

The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: OSSL Module. Supported versions that are affected are...

ROS-20261021-73-0042

The vulnerability in ElasticSearch is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely HTTP request smuggling attack...

PT-2026-120188

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server,...

PT-2026-120566

Inconsistent interpretation of HTTP requests HTTP request/response smuggling in the bundled HTTP/1.1 parser of Apache bRPC version 1.18.0 on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same byte...

PT-2026-120689

Name of the Vulnerable Software and Affected Versions Cisco Expressway Series affected versions not specified Description Insufficient authorization checks of HTTP requests during Mobile and Remote Access MRA provisioning allow an unauthenticated remote attacker to obtain sensitive information. A...

Cisco TelePresence Video Communication Server (VCS) Expressway: CVE-2026-76435: Cisco Expressway Series Information Disclosure Vulnerability

A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access MRA provisioning. An attacker could...

Linux Distros Unpatched Vulnerability : CVE-2026-101356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response...

Oracle Access Manager (October 2026 CPU)

The 12.2.1.4.0 and 14.1.2.1.0 versions of Access Manager installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Support...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-142315)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142315 advisory. A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the soupmessagenew function, could inject arbitrary headers and additional...

Linux Distros Unpatched Vulnerability : CVE-2026-113866

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-gunicorn (UTSA-2026-142339)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142339 advisory. Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling HRS vulnerabilities. By crafting requests with conflicting...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-142310)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142310 advisory. A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Squid vulnerabilities (USN-8941-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8941-1 advisory. It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker cou...