147294 matches found
CVE-2026-57487 libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser-contentlength at zero while parserparsechunkyentity and parserparsechunkybody accumulate decode...
CVE-2026-70188
Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Produ...
CVE-2026-88092
Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...
CLSA-2026-1792162107 TuxCare security update for web3-providers-http (1 CVE)
TuxCare rebuilt web3-providers-http to address 1 CVE. Fixed in 1.10.4-tuxcare.1...
CVE-2026-18516
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
CVE-2026-18516
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
EUVD-2026-102873
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
CVE-2026-18516
The Audit Logs component of Crafty Controller is vulnerable to an output escaping flaw (CWE-116 ). A remote, unauthenticated attacker can perform stored cross-site scripting (XSS) by leveraging HTTP header injection . No specific remediation or exploit details are provided in the documents.
Security update for libsoup2
This update for libsoup2 fixes the following issues: CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol...
SUSE-SU-2026:4703-1 Security update for libsoup2
This update for libsoup2 fixes the following issues: - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch bsc1272195. - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol...
Security Bulletin: IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI [CVE-2026-96119]
Summary IBM i is vulnerable to allowing a remote authenticated attacker to execute arbitrary code due to improper data sanitization CVE-2026-96119 in HTTP Server Administration Graphical User Interface GUI as described in the vulnerability details section. Vulnerability Details ID: CVE-2026-96119...
SUSE CVE-2026-100347
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation...
SUSE CVE-2026-109527
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...
libsoup security update
An update is available for libsoup. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libsoup packages provide an HTTP client and server library for GNOME...
OESA-2026-4389 libsoup security update
libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: SoupAuthManager caches proxy authentication credentials without scoping them to...
OESA-2026-4390 libsoup security update
libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: SoupAuthManager caches proxy authentication credentials without scoping them to...
OESA-2026-4365 httpd security update
Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version...