PT-2026-115210

Name of the Vulnerable Software and Affected Versions undici versions 7.15.0 through 7.30.0 undici versions 8.0.0 through 8.12.1 Description The decompress interceptor in this Node.js HTTP client library forwards decompressed response data to the downstream handler via zlib stream event callbacks...

CVE-2026-104150: Uncontrolled Resource Consumption

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an...

PT-2026-115113

Name of the Vulnerable Software and Affected Versions AdonisJS HTTP Server versions prior to 8.2.2 AdonisJS HTTP Server versions prior to 9.1.1 Description A Regular Expression Denial of Service ReDoS exists in the built-in slug route matcher. The regular expression used by router.matchers.slug...

UBUNTU-CVE-2026-101899

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NOPROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NOPROXY while a proxy is...

PT-2026-114895

A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt...

PT-2026-114427

SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP...

PT-2026-114951

Name of the Vulnerable Software and Affected Versions symfony/http-foundation versions 4.1.0-BETA1 through 5.4.53 symfony/http-foundation versions 6.0.0-BETA1 through 6.4.45 symfony/http-foundation versions 7.0.0-BETA1 through 7.4.18 symfony/http-foundation versions 8.0.0-BETA1 through 8.1.6...

curl/libcurl 8.22.0 HTTP/2 Upload Use-After-Free

curl/libcurl versions 8.12.0 through 8.22.0 contain an HTTP/2 upload use-after-free when processing RSTSTREAM frames. The supplied proof of concept provides local assessment and an opt-in loopback protocol probe. https://packetstorm.news/download/235856...

PT-2026-115223

EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1 20260617182218 release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a...

WS-2026-0146

@modelcontextprotocol/sdk 1.10.0-1.30.0, @modelcontextprotocol/server and @modelcontextprotocol/node 2.0.0 and prereleases, @modelcontextprotocol/hono 2.0.0 and prereleases: HTTP server transports and handlers put no limit on request body size or JSON-RPC batch length, so an unauthenticated clien...

PT-2026-115368

Name of the Vulnerable Software and Affected Versions Sliver versions prior to 1.7.3 Description Sliver is subject to a Denial of Service DoS issue where an unauthenticated user can exhaust the server's RAM, potentially crashing the host device. The issue occurs when an open HTTP listener receive...

CVE-2026-79829: Improper Input Validation

A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt...

CVE-2026-105660: Improper Validation of Syntactic Correctness of Input

Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validate...

CVE-2026-93649: Download of Code Without Integrity Check

In the Eclipse Adoptium website adoptium.net, in every deployment built from commit 0b24ea1 2025-06-18 up to the fix in commit cbb53cf 2026-09-24, the post-download page /locale/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta...

CVE-2026-84731: Missing Authentication for Critical Function

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters...

CVE-2026-18659: Incorrect Authorization

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

CVE-2026-105036: Download of Code Without Integrity Check

EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.120260617182218release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a...

CVE-2026-102475: Allocation of Resources Without Limits or Throttling

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerabilit...

CVE-2026-0993: Buffer Copy without Checking Size of Input

SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP...

PT-2026-114837

Name of the Vulnerable Software and Affected Versions undici versions 8.11.0 through 8.11.1 Description The experimental WebSocket client in this Node.js HTTP client library mishandles failed WebSocket handshakes over HTTP/2. Because the request is marked as completed, the abort operation is...