147638 matches found
CVE-2026-105659: Uncontrolled Resource Consumption
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...
PT-2026-122310
Security vulnerability affects the solr package. A client may issue specially crafted HTTP/1...
PT-2026-114425
Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1 Description When processing an HTTP redirect to a URL containing userinfo a username:password component, curl may incorrectly retain and re-transmit the HTTP Negotiate authentication state from the original...
CVE-2026-102479: Inconsistent Interpretation of HTTP Requests
In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as...
FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-60021): Gitea -- multiple vulnerabilities
Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request...
CVE-2026-59951: Uncontrolled Resource Consumption
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamablehttpapp, and StreamableHTTPSessionManager, retain session entries without an id...
PT-2026-114277
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A flaw allows a token with write:user scope to register an attacker-controlled SSH public key on the account of the token owner. API requests signed with the corresponding private key...
PT-2026-113742
Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An HTTP proxy can trick libcurl into sending the origin's credentials, such as Basic passwords or Negotiate/Kerberos tickets, directly to the proxy. This occurs when the proxy responds to a...
CVE-2026-110835: Improper Neutralization of CRLF Sequences
FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...
PT-2026-114149
Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description An HTTP header injection issue exists in the proxy component. This occurs because a lone Line Feed LF character within the target portion of a routing token, specifically in the Cookie: msts=...
CVE-2026-103930: Improper Neutralization of CRLF Sequences in HTTP Headers
cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline without the detail::encodepath protection used by the ordinary buffered request path. Raw carriage-return and...
CVE-2026-109527: Allocation of Resources Without Limits or Throttling
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...
PT-2026-114182
Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.79.0 Description An issue exists where users can trigger server-side request forgery, a flaw that allows a server to be coerced into making requests to an unintended location. This occurs when the shared HTTP clie...
CVE-2026-76083: Server-Side Request Forgery (SSRF)
Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/queryrunner/jsonds.py used getallresults to combine its configured baseurl with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured...
PT-2026-113943
Name of the Vulnerable Software and Affected Versions Dgraph versions prior to 25.4.0 Description Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. A remote unauthenticated attacker with access to the Zero HTTP port...
PT-2026-122878
TuxCare rebuilt http-proxy-middleware to address 2 CVEs. Fixed in 4.0.0-tuxcare.1...
PT-2026-114020
Name of the Vulnerable Software and Affected Versions mcp versions prior to 1.29.1 mcp versions 2.0.0a1 through 2.0.1 Description The Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. ...
PT-2026-114019
Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive a...
PT-2026-114013
The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...