Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

CVE-2026-102475

A flaw was found in Eclipse Vert.x HTTP proxy. A remote attacker can cause a Denial of Service DoS by triggering unbounded memory allocation on the server. When the proxy is configured with an intercepting body transformer, buffer limits are not properly enforced, allowing requests to continuousl...

PYSEC-2026-4200 Apprise forwards configured auth headers across cross-origin HTTP redirects

Summary Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders apprise/attachment/http.py, apprise/config/http.py follow HTTP 3xx redirects by default and re-send the user-configured auth headers and query parameters on the redirected request. If an operator-configured...

Apprise forwards configured auth headers across cross-origin HTTP redirects

SummaryApprise's HTTP-based notification plugins and its HTTP attachment / config loaders apprise/attachment/http.py, apprise/config/http.py follow HTTP 3xx redirects by default and re-send the user-configured auth headers and query parameters on the redirected request. If an operator-configured...

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

SummaryPraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization and no Origin can initialize and...

PYSEC-2026-4257 PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization and no Origin can initialize and...

Docling: Configured HTTP headers sent to every remote image host named by a document

SummaryHTMLBackendOptions.headers is documented for passing authentication headers API keys, bearer tokens when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled ima...

auto-qchem (>=0.1.1, <=1.2.6), crsmongo (>=1.0.0, <=1.0.6) +5 more potentially affected by CVE-2026-96749 via pymongo (3.10.0)

pymongo PYPI version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - auto-qchem =0.1.1, =1.0.0, =0.1.24, =0.0.1, =0.1.0, =0.1.10, =2.0.7, =2.3.2 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...

auto-qchem (>=0.1.1, <=1.2.6), crsmongo (>=1.0.0, <=1.0.6) +5 more potentially affected by CVE-2026-88029 via pymongo (3.10.0)

pymongo PYPI version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - auto-qchem =0.1.1, =1.0.0, =0.1.24, =0.0.1, =0.1.0, =0.1.10, =2.0.7, =2.3.2 Source cves: CVE-2026-88029 Source advisory: OSV:PYSEC-2026-4294...

CVE-2026-79829

A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt...

DEBIAN-CVE-2026-18662

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...