138647 matches found
Proxy And DNS Bypass
axios is vulnerable to Proxy and DNS bypass. The vulnerability is due to the HTTP/2 adapter not applying the caller‑supplied lookup function and proxy configuration, where the adapter builds the session with http2.connectauthority, http2Options using only the http2Options object and therefore omi...
CLEANSTART-2024-IW99789 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service
Security vulnerability affects the nghttp2 package. Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service...
CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal
A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...
CVE-2026-13313
An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected...
CVE-2026-13313
An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected...
CLEANSTART-2026-EH49722 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0
CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...
CLEANSTART-2026-GO38541 Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5
Security vulnerability affects the apache-nifi package. Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5...
CLEANSTART-2026-PR17240 Uncontrolled Resource Consumption vulnerability in the HTTP/1
Security vulnerability affects the apache-nifi package. Uncontrolled Resource Consumption vulnerability in the HTTP/1...
CLEANSTART-2026-UE75885 In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition
Security vulnerability affects the apache-nifi package. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition...
CLEANSTART-2026-AQ60759 When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written
Security vulnerability affects the apache-nifi package. When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written...
CLEANSTART-2026-PE66600 In Eclipse Jetty, a first HTTP/1
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, a first HTTP/1...
CLEANSTART-2026-HR51503 In Eclipse Jetty, an HTTP URI of this form: /public;/
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, an HTTP URI of this form: /public;/...
CLEANSTART-2026-WX23354 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...
CLEANSTART-2026-GI93885 In Eclipse Jetty, the HTTP/1
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the HTTP/1...
CLEANSTART-2026-CH48185 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface
Security vulnerability affects the kube-state-metrics-fips package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...
PT-2026-105200
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter values into non-garbage-collected Erlang atoms before bounding them or checking a fixed allowlist. Exploitation requires network access to th...
PT-2026-105155
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...
PT-2026-103982
Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...
PT-2026-104058
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison segment descriptors such as tcp data port or re-crea...