PT-2026-117325

A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are...

PT-2026-117339

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...

PT-2026-117341

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...

PT-2026-117363

Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with t...

ROS-20261019-73-0032

The vulnerability of the ASP.NET Core software platform is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions remotely...

ROS-20261019-73-0067

The vulnerability in python-h2 is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a remote attacker to send hidden HTTP requests a type of HTTP request smuggling attack...

Apache HTTP Server 2.4.63 TLS Upgrade Session Hijacking

Apache HTTP Server version 2.4.63 with modssl configured with SSLEngine optional contains an HTTP desynchronization flaw that allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. https://packetstorm.news/download/236361...

Apache Camel 4.22.0 Platform HTTP CORS Credential Exposure

Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain a CORS flaw in camel-platform-http-vertx that reflects arbitrary Origin values and permits credentials when CORS is enabled without configured origins. The included proof of concept demonstrates the issue...

ALSA-2026:84798 Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding...

PT-2026-117551

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

PT-2026-118075

Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTPS Listener PNG Decoder in github.com/bishopfox/sliver...

PT-2026-117702

IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery SSRF that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during...

CVE-2026-85317: Use of Cache Containing Sensitive Information

Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...

CVE-2026-85316: Insufficient Granularity of Access Control

Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with t...

CVE-2026-85254: Improper Handling of Case Sensitivity

Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, whi...

CVE-2026-85251: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than...

CVE-2026-84176: Permissive Cross-domain Policy with Untrusted Domains

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...

CVE-2026-80343: Improper Handling of Case Sensitivity

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...

CVE-2026-78164: Improper Neutralization of Special Elements Used in a Template Engine

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before...

CVE-2026-112103: Improper Certificate Validation

A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are...