EUVD-2026-76937

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

CVE-2026-90668

UnrealIRCd versions 6.0.5 through 6.2.6 contain a denial-of-service vulnerability in its webserver component. The server does not limit the number of HTTP request headers, allowing a remote unauthenticated attacker to send a single HTTP request with an unlimited number of headers, causing excessi...

PT-2026-90782

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

GHSA-V25G-MVWR-F5FP webhookd: Unrestricted HTTP Header to Shell Variable Injection

Description Before 1.22, if the Basic Auth htpasswd middleware was not configured, all incoming HTTP headers were blindly forwarded to the webhook script execution environment as shell variables. While the Basic Auth middleware correctly strips the authentication header X-WebAuthn-User from the...

webhookd: Unrestricted HTTP Header to Shell Variable Injection

Description Before 1.22, if the Basic Auth htpasswd middleware was not configured, all incoming HTTP headers were blindly forwarded to the webhook script execution environment as shell variables. While the Basic Auth middleware correctly strips the authentication header X-WebAuthn-User from the...

WordPress HTTP Headers plugin <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE vulnerability

Authenticated Administrator+ External Control of File Name or Path to RCE vulnerability discovered by Chiao-Lin Yu Steven Meow - Trend Micro in WordPress Plugin HTTP Headers versions = 1.19.2...

CVE-2026-73276

A flaw was found in the Erlang/OTP inets httpd server. This vulnerability allows a remote attacker to perform HTTP Request Smuggling due to the server silently dropping HTTP headers that contain whitespace between the header field-name and the colon. When deployed behind a reverse proxy that...

CVE-2026-86485

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks...

CVE-2026-86485

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks...

CVE-2026-86485

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks...

CVE-2026-86485

JetBrains YouTrack prior to version 2026.2.18634 is vulnerable to IP spoofing via HTTP headers , which allowed an attacker to forge Bitbucket webhook events. The underlying cause is the lack of proper source validation on incoming webhook requests, permitting a local actor with user interaction t...

EUVD-2026-72501

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks...

CVE-2026-86485: Reliance on IP Address for Authentication

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks...

PT-2026-86857

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks...

EUVD-2026-71791

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpijsonstringescape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reac...

Linux Distros Unpatched Vulnerability : CVE-2026-86098

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpijsonstringescape function that writes beyond caller-supplied buffer...

CVE-2026-86098

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpijsonstringescape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reac...

CVE-2026-86098: Out-of-bounds Write

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpijsonstringescape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reac...

NPM: fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

NPM: fastify vulnerable to X-Forwarded- spoofing under trustProxy hop-count vulnerability discovered by ? in WordPress Npm fastify versions = 5.8.3, 5.12.1...

CVE-2026-79756: Improper Neutralization of Special Elements used in an OS Command

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...