137855 matches found
NetScaler 73.30 HTTP Request Smuggling
NetScaler version 73.30 contains an HTTP/1.1 chunk-size accumulator overflow that can cause request parsing desynchronization and request smuggling...
CVE-2026-105049
Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...
Praxis affected by HTTP/2 Bomb
Summary Multiple denial-of-service vulnerabilities have been discovered in HTTP/2 server implementations. All have been rated with a severity impact of Important. The vulnerabilities target HPACK, the header compression scheme in HTTP/2, where a small request can trigger large memory allocations ...
GHSA-CJCG-CXMH-9WCR Praxis affected by HTTP/2 Bomb
Summary Multiple denial-of-service vulnerabilities have been discovered in HTTP/2 server implementations. All have been rated with a severity impact of Important. The vulnerabilities target HPACK, the header compression scheme in HTTP/2, where a small request can trigger large memory allocations ...
CVE-2026-105049
Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...
CVE-2026-105049
Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...
CVE-2026-105049
Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...
CVE-2026-105049
Zilliz Attu versions prior to 3.0.0 are vulnerable to a missing authentication flaw in the Playground feature. This vulnerability allows unauthenticated attackers to proxy arbitrary HTTP and HTTPS requests to URLs on the public internet. No specific exploit details or remediation steps are provid...
EUVD-2026-91802
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device...
CVE-2026-82043 UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint
UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...
CVE-2026-82043 UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint
UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...
CVE-2026-82043 UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint
UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...
Security Bulletin: Vulnerability in i18next-http-middleware bundled with IBM Fusion and IBM Fusion HCI.
Summary IBM Fusion and IBM Fusion HCI include the i18next-http-middleware library, which is affected by multiple vulnerabilities, including prototype pollution, CRLF injection, and server-side request forgery vulnerabilities. CVE-2026-48714, CVE-2026-41683, CVE-2026-41690, CVE-2026-42353...
Security Bulletin: Vulnerability in aiohttp bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage.
Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the aiohttp library, which is affected by multiple vulnerabilities, including HTTP request smuggling and out-of-bounds read vulnerabilities. CVE-2026-69243, CVE-2026-69244. Vulnerability Details CVEID:CVE-2026-69243...
CVE-2026-94084
An invalid memory reference vulnerability exists in Suricata's HTTP/2 application-layer engine during multi-buffer management Http2ThreadMultiBuf. When inspected HTTP/2 response traffic triggers signature rules that evaluate the http.responseheader keyword simultaneously with and without sticky...
Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System
Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-44486 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to ...
CVE-2026-104441
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the valeur action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.p...
CVE-2026-86537 Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service
Uncaught exception, Loop with unreachable exit condition 'infinite loop', Integer underflow wrap or wraparound vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-86537 Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service
Uncaught exception, Loop with unreachable exit condition 'infinite loop', Integer underflow wrap or wraparound vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
