CVE-2026-101899

The Axios HTTP client (versions 1.15.0 through 1.20.0 ) contains a vulnerability where the shouldBypassProxy function incorrectly treats NO_PROXY CIDR entries as textual hostname suffixes instead of evaluating the network range. This causes requests targeting addresses covered by CIDR bypass rule...

SUSE-SU-2026:24239-1 Security update for go1.26

This update for go1.26 fixes the following issues: Update to go 1.26.9 bsc1255111: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. -...

OPENSUSE-SU-2026:22095-1 Security update for go1.26

This update for go1.26 fixes the following issues: Update to go 1.26.9 bsc1255111: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. -...

Security Bulletin: IBM i is Affected by an Improper Authentication Vulnerability in IBM Navigator for i [CVE-2026-93744].

Summary IBM i is vulnerable to a security bypass due to improper access control in IBM Navigator for i CVE-2026-93744 as described in the vulnerability details section. Vulnerability Details ID: CVE-2026-93744 DESCRIPTION: IBM Navigator for i could allow an unathenticated remote attacker to bypas...

ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

ASP.NET Core Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

DEBIAN-CVE-2026-109760

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109760

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109760

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109760 Mitigation bypass in the Networking: HTTP component

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

EUVD-2026-98520

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109760

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109760

The Networking: HTTP component in Mozilla products is subject to a mitigation bypass vulnerability. This issue affects Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . The vulnerability has been remediated in Firefox 158 , Firefox ESR 153.5 , Thunderbird 158 , and Thunderbird 153.5 . S...

CVE-2026-109760 Mitigation bypass in the Networking: HTTP component

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

SUSE-SU-2026:24237-1 Security update for go1.27

This update for go1.27 fixes the following issues: Update to go1.27.2 bsc1272545: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. -...

OPENSUSE-SU-2026:22093-1 Security update for go1.27

This update for go1.27 fixes the following issues: Update to go1.27.2 bsc1272545: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. -...

CVE-2026-109245

A flaw was found in FreeRDP. This vulnerability leads to information disclosure because the internal HTTP client fails to verify Transport Layer Security TLS server certificates or hostnames. An on-path network attacker positioned between the client and identity provider can exploit this flaw by...

CLSA-2026-1791887095 Fix CVE(s): CVE-2026-42356

SECURITY UPDATE: wrong handler on internal redirect from a CGI program - debian/patches/CVE-2026-42356.patch: do not propagate the trusted content-type flag to the target of an internal redirect in apinternalredirecthandler in modules/http/httprequest.c. - CVE-2026-42356...

CLSA-2026-1791886853 Fix CVE(s): CVE-2026-42356

SECURITY UPDATE: wrong handler on internal redirect from a CGI program - debian/patches/CVE-2026-42356.patch: do not propagate the trusted content-type flag to the target of an internal redirect in apinternalredirecthandler in modules/http/httprequest.c. - CVE-2026-42356...

CVE-2026-85115

A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API All versions V3.3.62. Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow an attacker with access to logs or other diagnostic output to obtai...