Quarkus Java Framework Data Compromise

The vulnerability of the Quarkus framework is related to incorrect interpretation of HTTP requests. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of the protected information...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130123)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130123 advisory. Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through...

CVE-2026-92392: Use After Free

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

libwasmtime -- Multiple vulnerabilities

Wasmtime development team reports: Out-of-bounds zero-length stream writes can panic. Host panic when component callasync is cancelled under some conditions. Panic on erroneous call-to-host from guest realloc call. Yielding in a component start function can lead to a host panic. Panic when invoki...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-60021): Gitea -- multiple vulnerabilities

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request...

PT-2026-114277

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A flaw allows a token with write:user scope to register an attacker-controlled SSH public key on the account of the token owner. API requests signed with the corresponding private key...

PT-2026-114182

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.79.0 Description An issue exists where users can trigger server-side request forgery, a flaw that allows a server to be coerced into making requests to an unintended location. This occurs when the shared HTTP clie...

PT-2026-114013

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

PT-2026-114229

Name of the Vulnerable Software and Affected Versions mcp versions 1.8.0 through 1.29.9 mcp versions 2.0.0 through 2.1.9 Description Stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable http app, and StreamableHTTPSessionManager, retain session entries without an idle...

PT-2026-114019

Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive a...

CVE-2026-110835: Improper Neutralization of CRLF Sequences

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-102479: Inconsistent Interpretation of HTTP Requests

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as...

CVE-2026-105659: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...

PT-2026-122310

Security vulnerability affects the solr package. A client may issue specially crafted HTTP/1...

PT-2026-122290

Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Lightweight HTTP Server...

PT-2026-122878

TuxCare rebuilt http-proxy-middleware to address 2 CVEs. Fixed in 4.0.0-tuxcare.1...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130139)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130139 advisory. Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache...

CVE-2026-109506: Improper Authentication

Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive a...

RHEL 10 : libsoup3 (RHSA-2026:82728)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:82728 advisory. Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130102)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130102 advisory. Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from...