CVE-2026-107399

The Mechanize library (prior to version 2.14.1 ) fails to enforce an origin trust boundary within the Mechanize::HTTP::Agent#response_follow_meta_refresh function when follow_meta_refresh is enabled. This flaw allows a page containing a meta refresh to an external origin to cause the library to r...

CVE-2026-107399

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

EUVD-2026-95318

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

CVE-2026-107399 Mechanize sends credential headers to another origin after a meta refresh

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

MAL-2026-17704 Malicious code in @wxwxtest/testrrrdd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c288e48135ebe9f305d450f5b19324ae944865fb7057ced986d0eb30cb1fe34 The package ships a postinstall script scripts.postinstall runs node beacon.cjs and a top-level require'./beacon.cjs'.fire in index.js that POST...

Exploit for Path Traversal in Apache Http_Server

Apache HTTP Server 2.4.50 Path Traversal and RCE CVE-2021-420...

CVE-2026-78399

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of service using a specially crafted HTTP query due to improper allocation of system resources...

CVE-2026-78399

IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3) are vulnerable to a Denial of Service (DoS) attack. An authenticated user can trigger the DoS by sending a specially crafted HTTP query , which leads to an improper allocation...

EUVD-2026-95272

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of service using a specially crafted HTTP query due to improper allocation of system resources...

CVE-2026-78399 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of service using a specially crafted HTTP query due to improper allocation of system resources...

curl: HTTP/1.1 connection reuse returns unsolicited server data as the next request's response (regression in 8.22.0)

Since 8.22.0 libcurl reuses an idle HTTP/1.1 connection that already has unread bytes waiting on it, as long as the pool health check ran less than a second ago, and those bytes are then returned as the response to the next request sent on that connection, so every later response on it is shifted...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat

Tomcat PUT Arbitrary File Write CVE-2017-12615 Vulhubhtt...

RHLW-2026-37913C8C5F4BDEA1 Lightwell Security Advisory: jetty-ee10-demo-async-rest-jar 12.0.32.rhlw-00002

Red Hat Lightwell has released org.eclipse.jetty.ee10.demos:jetty-ee10-demo-async-rest-jar 12.0.32.rhlw-00002 with a backported security fix. CVE-2026-2332: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing This patched artifact is a drop-in replacement for...

CVE-2026-107294

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, webfetchtool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An...

ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6), app.peac:core (0.0.1) +2426 more potentially affected by CVE-2024-53990 +1 more via org.asynchttpclient:async-http-client (>=2.1.0, <=2.16.1)

org.asynchttpclient:async-http-client MAVEN version =2.1.0, =1.7, =4.1.0, =4.0.0-beta.2, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.9.2 and more Source cves: CVE-2024-53990, CVE-2026-107228 Source advisory: OSV:GHSA-2JWH-9RMR-J4XF...

EUVD-2026-94589

AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader Bypass of CVE-2024-53990 Fix...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.5), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +93 more potentially affected by CVE-2024-53990 +1 more via org.asynchttpclient:async-http-client (>=3.0.0, <=3.0.13)

org.asynchttpclient:async-http-client MAVEN version =3.0.0, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =2.0.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =0.0.11 and more Source cves: CVE-2024-53990, CVE-2026-107228 Source advisory: OSV:GHSA-2JWH-9RMR-J4XFhttps://...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.5), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +93 more potentially affected by CVE-2024-53990 +1 more via org.asynchttpclient:async-http-client (>=3.0.0, <=3.0.13)

org.asynchttpclient:async-http-client MAVEN version =3.0.0, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =2.0.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =0.0.11 and more Source cves: CVE-2024-53990, CVE-2026-107228 Source advisory: GHSA-2JWH-9RMR-J4XFhttps://vuln...

ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6), app.peac:core (0.0.1) +2426 more potentially affected by CVE-2024-53990 +1 more via org.asynchttpclient:async-http-client (>=2.1.0, <=2.16.1)

org.asynchttpclient:async-http-client MAVEN version =2.1.0, =1.7, =4.1.0, =4.0.0-beta.2, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.9.2 and more Source cves: CVE-2024-53990, CVE-2026-107228 Source advisory: GHSA-2JWH-9RMR-J4XF...

Protection Mechanism Failure

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Protection Mechanism Failure due to improper handling of the scheme when processing Set-Cookie headers. An attacker can overwrite, plant, or...