CVE-2026-108582

GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and generated documents. Attackers can list the world-readable genoffice-mcp-http directory under the system temporary directory to re...

EUVD-2026-96365

GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and generated documents. Attackers can list the world-readable genoffice-mcp-http directory under the system temporary directory to re...

dotdotpwn

DESCRIZIONE DotDotPwn - Il Fuzzer per Directory Traversal È un fuzzer molto flessibile e intelligente per scoprire vulnerabilità di directory traversal in software come server HTTP/FTP/TFTP, piattaforme web come CMS, ERP, Blog, ecc. Inoltre, dispone di un modulo indipendente dal protocollo per...

Denial Of Service (DoS)

github.com/jhaals/yopass is vulnerable to denial of service DoS. The vulnerability is due to the use of attacker-controlled HTTP method values as metric labels without validation, which allows an unauthenticated remote attacker to create numerous unique metric series, causing excessive memory...

CVE-2026-94375

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the getfilepath. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing custom...

EUVD-2026-96098

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the getfilepath. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing custom...

CVE-2026-94375 Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the getfilepath. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing custom...

CVE-2026-94375

The Order Export & Order Import for WooCommerce plugin for WordPress (versions

SUSE CVE-2026-56866

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...

SUSE CVE-2026-78659

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

SUSE CVE-2026-78660

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

SUSE CVE-2026-78663

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

SUSE CVE-2026-78669

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CLEANSTART-2026-EI20913 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the n8n package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-DH24226 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the n8n package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-MT76481 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the n8n package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-SB52604 When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and t...

Security vulnerability affects the activemq package. When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data...

CLEANSTART-2026-DF84636 It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak

CVE-2026-59295 affects multiple packages. It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service DoS condition due to an unbounded memory leak. See references for individual vulnerability details...

CLEANSTART-2026-AE51081 Uncontrolled Resource Consumption vulnerability in the HTTP/1

Security vulnerability affects the apache-nifi package. Uncontrolled Resource Consumption vulnerability in the HTTP/1...

CLEANSTART-2026-FS57151 In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition

Security vulnerability affects the apache-nifi package. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition...