curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse

A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTPS request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connectio...

curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse

A flaw was found in libcurl. When a user performs a transfer over an HTTP proxy using Digest authentication and then reuses the same handle for a second transfer with a different proxy host, libcurl incorrectly sends the Proxy-Authorization header intended for the first proxy to the second proxy...

libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service

A flaw was found in libcurl. This use-after-free vulnerability occurs when an application configures an HTTP/2 stream-dependency tree and then performs a sequence of operations involving curleasyreset and curleasycleanup. During the final cleanup, libcurl attempts to access memory that has alread...

hsecscan

hsecscan Un escáner de seguridad para cabeceras de respuesta HTTP. Requisitos Python 2.x Módulos de Python os.path argparse sqlite3 urlparse urllib2 urllib json ssl Instalación $ pip install hsecscan Uso $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D DBFILE -d 'POS...

proxify

Características • Instalación • Uso • Ejecutar Proxify • Instalación del Certificado SSL • Aplicaciones de Proxify • Unirse a Discord Proxy navaja suiza para despliegues rápidos. Soporta múltiples operaciones como volcado de peticiones/respuestas, filtrado y manipulación mediante lenguaje DSL,...

K000163653: Apache HTTP Server vulnerabilities CVE-2026-56449 and CVE-2026-57941

Security Advisory Description CVE-2026-56449 Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. CVE-2026-57941 Use After Free vulnerability in Apache HTTP Server's modhttp2 via...

PT-2026-110885

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

PT-2026-110777

Name of the Vulnerable Software and Affected Versions MONAI versions 0.4.0 through 1.6.0 Description An issue exists where on-path attackers can achieve remote code execution by tampering with SENet pretrained weights fetched over plaintext HTTP. This occurs when the load state dict from url...

Important: php8.5

Issue Overview: The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined...

CVE-2026-109575: Missing Authentication for Critical Function

In HAProxy Data Plane API 2.2.0 through 3.4.3 and corresponding Enterprise Edition releases, Server.ConfigureAPI has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority tlsca is configured and a numeric TLS...

PT-2026-110982

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC version 1.32 Description A security flaw exists in the HTTP Blocking Page component. A remote attacker can perform a manipulation of the /goform/formUrlb endpoint to execute cross site scripting, which is a technique used to...

Medium: perl-HTTP-Date

Issue Overview: parsedate -- and str2time, which delegates to it -- used regexes with ambiguous adjacent greedy runs year/clock/timezone digits and timezone/ASCII-timezone letters before a trailing anchor. A valid-looking date prefix followed by a long interior run of digits, letters, or whitespa...

PT-2026-120386

Уязвимость функции freerdp http request RDP-клиента FreeRDP связана с ошибками процедуры подтверждения подлинности сертификата. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, подменить RDP-сервер...

PT-2026-110493

Name of the Vulnerable Software and Affected Versions OTRS Community Edition versions 6.x and earlier Description The HTTP Basic Authentication modules trust the authenticated username provided via the REMOTE USER or HTTP REMOTE USER environment variables. In CGI and mod perl based deployments,...

CVE-2026-109309: Improper Limitation of a Pathname to a Restricted Directory

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...

PT-2026-110726

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...

CVE-2026-77363: Origin Validation Error

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a maliciou...

Important: httpd

Issue Overview: Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This...

CVE-2026-109360: Deserialization of Untrusted Data

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that loadstatedictfromurl unpickles without weightsonly=True,...

CVE-2026-83536: Uncontrolled Resource Consumption

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...