Linux Distros Unpatched Vulnerability : CVE-2026-107718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130142)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130142 advisory. Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow...

PT-2026-122264

Security vulnerability affects the openjdk21 package. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Debian dsa-6558 : curl - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6558 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6558-1 [email protected] https://www.debian.org/securit...

PT-2026-113740

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A remote HTTP server can set a cookie that is accepted and written to a Netscape cookie jar but cannot be reloaded. When curl is subsequently invoked using the same path for the --cookie and...

PT-2026-114313

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An issue exists during the HSTS cache import process where importing a parent HSTS entry with the includeSubDomains flag before a longer-lived child entry causes the child entry to be silently...

Linux Distros Unpatched Vulnerability : CVE-2026-92392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct...

PT-2026-114179

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.60.1 Description An allowlist bypass exists that enables repository users to circumvent the allowedHeaders restriction. This occurs when hostRules headers are placed within shared presets. An attacker can provide...

Unity Linux 20.1070a Security Update: grafana-pcp (UTSA-2026-130122)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130122 advisory. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

Unity Linux 20.1070a Security Update: grafana (UTSA-2026-130138)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130138 advisory. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

CVE-2026-109527: Allocation of Resources Without Limits or Throttling

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

PT-2026-114020

Name of the Vulnerable Software and Affected Versions mcp versions prior to 1.29.1 mcp versions 2.0.0a1 through 2.0.1 Description The Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. ...

PT-2026-113982

Name of the Vulnerable Software and Affected Versions bandit versions 1.4.0 and later Description Uncontrolled resource consumption allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely. By sending a trickle of small WINDOW UPDATE frames or empty SETTINGS frames, a...

Linux Distros Unpatched Vulnerability : CVE-2026-95101

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an...

PT-2026-122327

Security vulnerability affects the openjdk17 package. The llhttp parser in the http module in Node v20...

PT-2026-114233

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The initial GitLab migration version probe utilizes an HTTP client that lacks a timeout and fails to attach the migration task's cancellation context. An authenticated user capable of initiatin...

PT-2026-113940

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 5.0.0 through 5.0.12 Eclipse Vert.x versions 5.1.0 through 5.1.9 Eclipse Vert.x version 5.2.0 Description The HTTP/1.x decoder in the io.vertx:vertx-core component uses a canonicalization process for well-known HTTP...

PT-2026-113943

Name of the Vulnerable Software and Affected Versions Dgraph versions prior to 25.4.0 Description Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. A remote unauthenticated attacker with access to the Zero HTTP port...

CVE-2026-110865: Improper Protection of Alternate Path

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules.headers to inject cust...

CVE-2026-95101: Encoding Error

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...