SUSE CVE-2026-56866

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...

SUSE CVE-2026-78659

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

SUSE CVE-2026-78660

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

SUSE CVE-2026-78663

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

SUSE CVE-2026-78669

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CLEANSTART-2026-DH24226 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the n8n package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-EI20913 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the n8n package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-MT76481 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the n8n package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-SB52604 When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and t...

Security vulnerability affects the activemq package. When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data...

CLEANSTART-2026-DF84636 It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak

CVE-2026-59295 affects multiple packages. It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service DoS condition due to an unbounded memory leak. See references for individual vulnerability details...

CLEANSTART-2026-AE51081 Uncontrolled Resource Consumption vulnerability in the HTTP/1

Security vulnerability affects the apache-nifi package. Uncontrolled Resource Consumption vulnerability in the HTTP/1...

CLEANSTART-2026-FS57151 In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition

Security vulnerability affects the apache-nifi package. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition...

CLEANSTART-2026-RV47518 When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written

Security vulnerability affects the apache-nifi package. When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written...

CLEANSTART-2026-BC80499 In Eclipse Jetty, an HTTP URI of this form: /public;/

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, an HTTP URI of this form: /public;/...

CLEANSTART-2026-EB27094 In Eclipse Jetty, a first HTTP/1

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, a first HTTP/1...

CLEANSTART-2026-ZE47134 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...

CLEANSTART-2026-PV64921 In Eclipse Jetty, the HTTP/1

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the HTTP/1...

PT-2026-117847

Security vulnerability affects the apache-nifi package. When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written...

CVE-2026-108582: Incorrect Permission Assignment for Critical Resource

GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and generated documents. Attackers can list the world-readable genoffice-mcp-http directory under the system temporary directory to re...

CVE-2026-94375: Files or Directories Accessible to External Parties

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the getfilepath. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing custom...