RHEL 8 : pcs (RHSA-2026:84798)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84798 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado:...

CVE-2026-112103: Improper Certificate Validation

A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are...

CVE-2026-111750: Inconsistent Interpretation of HTTP Requests

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTPNOEXTENSIONS or otherwise runs without a...

ALSA-2026:84798 Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding...

CVE-2026-85254: Improper Handling of Case Sensitivity

Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, whi...

CVE-2026-80343: Improper Handling of Case Sensitivity

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...

CVE-2026-78164: Improper Neutralization of Special Elements Used in a Template Engine

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before...

Apache HTTP Server 2.4.63 TLS Upgrade Session Hijacking

Apache HTTP Server version 2.4.63 with modssl configured with SSLEngine optional contains an HTTP desynchronization flaw that allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. https://packetstorm.news/download/236361...

PT-2026-118075

Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTPS Listener PNG Decoder in github.com/bishopfox/sliver...

Apache Camel 4.22.0 Knative HTTP Consumer Information Disclosure

Apache Camel version 4.22.0 camel-knative HTTP consumers disclose exception class names, messages, and stack traces to remote callers after a route failure. The supplied proof of concept demonstrates affected and fixed behavior. https://packetstorm.news/download/236341...

PT-2026-133175

TuxCare rebuilt http-proxy-middleware to address 2 CVEs. Fixed in 3.0.5-tuxcare.1...

Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding...

PT-2026-117221

A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r core cmd str pipe in the library libr/core/rtr http.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the...

PT-2026-117363

Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with t...

PT-2026-117325

A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are...

PT-2026-117353

Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, whi...

PT-2026-117702

IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery SSRF that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during...

CVE-2026-102503: Missing Authentication for Critical Function

Missing Authentication for Critical Function CWE-306 and Missing Authorization CWE-862 in the /libp2p-http ingress server StartIngressServer in cmd/sam-node/node.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass...

PT-2026-117364

Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...

CVE-2026-85316: Insufficient Granularity of Access Control

Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with t...