CVE-2026-85317: Use of Cache Containing Sensitive Information

Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...

Apache Camel 4.22.0 Platform HTTP CORS Credential Exposure

Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain a CORS flaw in camel-platform-http-vertx that reflects arbitrary Origin values and permits credentials when CORS is enabled without configured origins. The included proof of concept demonstrates the issue...

RHEL 8 : pcs (RHSA-2026:85135)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:85135 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado:...

AlmaLinux 8 : pcs (ALSA-2026:84798)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:84798 advisory. python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request Smuggli...

RHEL 8 : pcs (RHSA-2026:84844)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84844 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado:...

CVE-2026-105661

Requesting /username/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for ea...

CVE-2026-105661

Requesting "/username/-/repositories" for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for...

CVE-2026-105661 Gitea panic on the repositories route of individual users

Requesting /username/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for ea...

CVE-2026-105661

The Gitea platform is vulnerable to a NULL pointer dereference (CWE-476) and an uncaught exception (CWE-248). When an unauthenticated user requests /{username}/-/repositories for an individual user instead of an organization, the organization home handler dereferences a nil organization object. T...

CVE-2026-105661 Gitea panic on the repositories route of individual users

Requesting /username/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for ea...

CVE-2026-105661 Gitea panic on the repositories route of individual users

Requesting /username/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for ea...

CVE-2026-109553

The Gitea Git repository management system is vulnerable to unauthorized access due to a flaw in the VerifyCert() function. The system incorrectly resolves SSH certificate principals by searching the content of all stored public keys instead of only the principal keys. If Gitea is configured to t...

CVE-2026-109553 Gitea SSH certificate principal impersonation of other users

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSHTRUSTEDUSERCAKEYS and accepts arbitrary principals SSHAUTHORIZEDPRINCIPALSALLOW=anything, a user could register...

CVE-2026-109553 Gitea SSH certificate principal impersonation of other users

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSHTRUSTEDUSERCAKEYS and accepts arbitrary principals SSHAUTHORIZEDPRINCIPALSALLOW=anything, a user could register...

CVE-2026-109553 Gitea SSH certificate principal impersonation of other users

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSHTRUSTEDUSERCAKEYS and accepts arbitrary principals SSHAUTHORIZEDPRINCIPALSALLOW=anything, a user could register...

[SECURITY] [DLA 4842-1] haproxy security update

Debian LTS Advisory DLA-4842-1 [email protected] https://www.debian.org/lts/security/ Santiago Ruano Rincón October 18, 2026 https://wiki.debian.org/LTS Package : haproxy Version : 2.6.12-1+deb12u4 CVE ID : CVE-2026-33555, not yet available Three vulnerabilities were discovered in...

Radare2 processing logic error vulnerability

Radare2 versions 6.2.0 and 6.2.2 have a processing logic vulnerability. This vulnerability stems from the operation of the rcorecmdstrpipe function in the libr/core/rtrhttp.inc.c library within the HTTP Sandbox Policy Handler component. This operation causes the protection mechanism to fail,...

Apache Camel code injection vulnerability

Apache Camel versions from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain security vulnerabilities. These vulnerabilities stem from the Camel HTTP producer, which allows inbound messages to override endpoint URIs through the CamelHttpUri and CamelRestHttpUri headers. It also parses property...

Apache Camel permission and access control vulnerabilities

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain vulnerabilities related to permission handling and access control. These vulnerabilities arise from the Platform HTTP component, which determines whether endpoints run in proxy mode by checking whether a path starts...

Fat-Free Factory’s fatfree-core authorization issue vulnerability

The Fat-Free Factory versions 3.9.2 and earlier contain security vulnerabilities. These vulnerabilities stem from improper certificate verification in the curl function within the web.php file of the HTTP Client component. This could allow remote attackers to bypass certificate verification...