149076 matches found
CVE-2026-18659: Incorrect Authorization
In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...
PT-2026-115093
Name of the Vulnerable Software and Affected Versions react/http versions 1.0.0 through 1.11.0 Description ReactHttpBrowser fails to enforce a size limit on the internal buffer used to store response-header bytes. When the handleData function in ClientRequestStream receives data, it appends...
PT-2026-115223
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1 20260617182218 release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a...
PT-2026-114868
Name of the Vulnerable Software and Affected Versions jetty-security affected versions not specified jetty-eeN-security affected versions not specified jetty-eeN-servlet affected versions not specified Description Jakarta Spec constraints defined as http-method-omission can be bypassed by using...
PT-2026-114951
Name of the Vulnerable Software and Affected Versions symfony/http-foundation versions 4.1.0-BETA1 through 5.4.53 symfony/http-foundation versions 6.0.0-BETA1 through 6.4.45 symfony/http-foundation versions 7.0.0-BETA1 through 7.4.18 symfony/http-foundation versions 8.0.0-BETA1 through 8.1.6...
PT-2026-114978
Name of the Vulnerable Software and Affected Versions kin-openapi versions prior to 0.145.0 Description An unauthenticated remote client can trigger a denial of service by sending an unsupported or non-canonical HTTP method such as PROPFIND or lowercase get to an existing static path. The...
PT-2026-122726
Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...
CVE-2026-79829: Improper Input Validation
A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt...
Unity Linux 20.1070e Security Update: libsoup (UTSA-2026-130370)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130370 advisory. A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soupheadersparse can cause...
HPE NonStop HTTP WEBSERVER input validation error vulnerability
The HPE NonStop HTTP WEBSERVER T1144L24 AAL and earlier versions contain an input validation error vulnerability caused by memory corruption, which may lead to a system crash...
CVE-2026-104150: Uncontrolled Resource Consumption
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an...
CVE-2026-109855: Uncaught Exception
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the...
CVE-2026-104827: Allocation of Resources Without Limits or Throttling
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...
CVE-2026-0993: Buffer Copy without Checking Size of Input
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP...
CVE-2026-84731: Missing Authentication for Critical Function
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters...
CVE-2026-105660: Improper Validation of Syntactic Correctness of Input
Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validate...
WS-2026-0146
@modelcontextprotocol/sdk 1.10.0-1.30.0, @modelcontextprotocol/server and @modelcontextprotocol/node 2.0.0 and prereleases, @modelcontextprotocol/hono 2.0.0 and prereleases: HTTP server transports and handlers put no limit on request body size or JSON-RPC batch length, so an unauthenticated clien...
UBUNTU-CVE-2026-109855
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the...