CVE-2026-87029

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while...

CVE-2026-100347

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending requests with unsupported or non-canonical HTTP methods to an existing static path. Because the application encounters an unhandled panic before authentication is evaluated, these...

CVE-2026-111235 OpenNMS REST authorization bypass via non-canonical HTTP method

An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/ Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no...

CVE-2026-111235 OpenNMS REST authorization bypass via non-canonical HTTP method

An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/ Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no...

CVE-2026-111235 OpenNMS REST authorization bypass via non-canonical HTTP method

An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/ Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no...

CVE-2026-104150 AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an...

CVE-2026-104150 AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an...

@adonisjs/core (>=5.0.5-canary-rc-1, <=6.21.0), @akago/akago_backend_commands (>=1.0.0, <=1.2.8) +53 more potentially affected by CVE-2026-104150 via @adonisjs/http-server (>=5.12.0, <=7.8.1)

@adonisjs/http-server NPM version =5.12.0, =5.0.5-canary-rc-1, =1.0.0, =1.0.1, =1.0.0, =0.0.3, =1.0.0, =1.0.0, =1.0.3, =1.0.0, =1.0.0, =1.0.0, =1.0.1, =1.0.3, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-104150 Source advisory: MEND:CVE-2026-104150...

CVE-2026-104150

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an...

CVE-2026-104150 AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an...

EUVD-2026-102320

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an...

CVE-2026-104150

The AdonisJS HTTP Server package (prior to versions 8.2.2 and 9.1.1 ) is vulnerable to Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity (CWE-400, CWE-1333). The router.matchers.slug() function contains a regular expression with adjacent greedy repetitions and overla...

CVE-2026-59951

A flaw was found in the Model Context Protocol MCP Python SDK. Stateful streamable HTTP servers fail to enforce idle session expiration or limits on active sessions, preventing terminated or rejected requests from releasing their resources. A remote attacker can exploit this issue by repeatedly...

CVE-2026-87018

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

CVE-2026-105660

The bandit web framework (versions 0.6.0 before 1.13.0 ) is vulnerable to an Improper Validation of Syntactic Correctness of Input (CWE-1286) issue. An unauthenticated remote attacker can manipulate the conn.host and conn.port values by providing an HTTP/1 absolute-form or authority-form request ...

CVE-2026-105660 Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit

Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validate...

CVE-2026-105660 Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit

Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validate...

CVE-2026-105660

Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validate...

EUVD-2026-102317

Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validate...

CVE-2026-105660 Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit

Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validate...