CVE-2026-94375: Files or Directories Accessible to External Parties

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the getfilepath. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing custom...

PT-2026-109673

Name of the Vulnerable Software and Affected Versions GenOffice versions prior to 0.11.506 Description An incorrect permissions issue exists in the HTTP MCP server file store. Local unprivileged users can access the world-readable genoffice-mcp-http directory located within the system temporary...

PT-2026-117719

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, an HTTP URI of this form: /public;/...

PT-2026-117834

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the HTTP/1...

PT-2026-117923

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...

CVE-2026-108582: Incorrect Permission Assignment for Critical Resource

GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and generated documents. Attackers can list the world-readable genoffice-mcp-http directory under the system temporary directory to re...

PT-2026-117847

Security vulnerability affects the apache-nifi package. When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written...

auto-repeater

AutoRepeater: Ripetizione automatica delle richieste HTTP con Burp Suite tl;dr All'interno di Extender importa AutoRepeater.jar Alcune brevi istruzioni AutoRepeater reinvierà solo le richieste modificate da una sostituzione definita. Quando AutoRepeater riceve una richiesta che corrisponde alle...

cdb

Pown CDB Pown CDB è un'utilità per il Chrome Debug Protocol. L'obiettivo principale dello strumento è automatizzare i compiti comuni per aiutare a eseguire il debug di applicazioni web dalla riga di comando e monitorare e intercettare attivamente richieste e risposte HTTP. Ciò è particolarmente...

Security Bulletin: Due to use of Apache Http Server, IBM Cloud Pak System is affected by HTTP Response splitting [CVE-2024-24795]

Summary HTTP Response splitting vulnerability has been identified in Apache HTTP Server. This vulnerability was addressed by IBM Cloud Pak System 2.3.6.2 Vulnerability Details CVEID:CVE-2024-24795 DESCRIPTION: HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker th...

CVE-2026-107824

x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...

CVE-2026-107820

x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcpserver.zig parses an unbounded Content-Length value in parseContentLength and uses it in unchecked usize addition in wsRecv before token...

CVE-2026-107824 x64dbg-MCP Server exposes debugger operations to unauthenticated network clients

x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...

CVE-2026-107824

The x64dbg-MCP Server plugin, a native Model Context Protocol (MCP) tool for x64dbg, is vulnerable to an authentication bypass in versions prior to 1.1 . The software exposes full debugger functionality over HTTP and SSE while listening on the default interface (0.0.0.0 ) without authentication. ...

CVE-2026-107824 x64dbg-MCP Server exposes debugger operations to unauthenticated network clients

x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...

CVE-2026-75597

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/ route in src/pyload/webui/app/blueprints/appblueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route /logs, /settings, /queue, /dashboard, etc...

SUSE CVE-2026-92543

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Becau...

SUSE CVE-2026-94439

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

SUSE CVE-2026-97032

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

Updated tomcat package fixes security vulnerabilities

OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. CVE-2026-73581 Cross-context authentication mix-up with Jakarta Authentication configured. CVE-2026-75973 Bypass of security constraints for WebSocket endpoints. CVE-2026-76183 Transfer-Encoding honored for...