CVE-2026-88092

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

CVE-2026-88092: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

CentOS Linux 8 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791914243)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1791914243 advisory. - Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs ...

MiracleLinux 8 : httpd:2.4 bug fix and enhancement update (AXBA:2026-2033:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXBA:2026-2033:01 advisory. - An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures 30 days in default configurations, to the backoff time...

CVE-2026-106172: Use of Hard-coded Cryptographic Key

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker...

CVE-2026-88092: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

CVE-2026-88092: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

PT-2026-112910

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.App.Runtime.linux-arm versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 8.0.0 through 8.0.31...

Tanchun: Robust Flow-Based HTTP(S) DDoS Detection Via Behavioral Attribute Guidance

HTTPS DDoS attacks have surged in frequency and scale, posing a significant threat to network security. Flow-based detection is a promising solution for large-scale HTTPS DDoS detection due to its decryption-free operation and scalability. However, the coarse-grained numerical statistics in flow...

PT-2026-111392

Name of the Vulnerable Software and Affected Versions .NET Client Library for SIMATIC S7 Webserver API versions prior to V3.3.62 Description Applications using the library do not properly redact PLC restore passwords from HTTP error exception messages. An attacker with access to logs or diagnosti...

PT-2026-111346

Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

PT-2026-122255

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

CVE-2026-108971: Improper Verification of Cryptographic Signature

A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfddecode of the file bootloaderregion.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may b...

Apache HTTP Server mod_vhost_alias() Code Execution

The vulnerability of the modvhostalias function in the Apache HTTP Server is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure or execute arbitrary code by sending a specially crafted HTTP...

Broken authorization

A missing authorization vulnerability CWE-862 in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP requests...

Red Hat: CVE-2026-61642: squid: squid: Request Smuggling in HTTP Transfer-Encoding

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

PT-2026-112289

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.App.Runtime.linux-arm versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions...

CVE-2026-101899: Protection Mechanism Failure

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NOPROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NOPROXY while a proxy is...

PT-2026-111480

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 158 Firefox ESR versions prior to 153.5 Thunderbird versions prior to 158 Thunderbird versions prior to 153.5 Description A mitigation bypass exists within the Networking: HTTP component. Recommendations Update Firefo...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Axios vulnerabilities (USN-8638-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8638-1 advisory. Ameer Assadi discovered that Axios did not properly handle certain hostnames when applying NOPROXY rules. An attacker...