EulerOS 2.0 SP11 : python-requests (EulerOS-SA-2026-4280)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with...

EulerOS 2.0 SP11 : httpd (EulerOS-SA-2026-4327)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server:...

EulerOS 2.0 SP13 : perl-HTTP-Tiny (EulerOS-SA-2026-4086)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx...

EulerOS 2.0 SP13 : mod_http2 (EulerOS-SA-2026-4163)

According to the versions of the modhttp2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP requests...

EulerOS 2.0 SP13 : nghttp2 (EulerOS-SA-2026-4074)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

AlmaLinux 9.6 [TuxCare] Security Update: ignition / ignition-edge / ignition-grub / ignition-validate (ALMALINUX9.6:CLSA-2026:1791487723)

"The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791487723 advisory. - gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input...

Rocky Linux 9.6 [TuxCare] Security Update: ignition / ignition-edge / ignition-grub / ignition-validate (ALMALINUX9.6:CLSA-2026:1791487723)

"The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791487723 advisory. - gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input...

PT-2026-110493

Name of the Vulnerable Software and Affected Versions OTRS Community Edition versions 6.x and earlier Description The HTTP Basic Authentication modules trust the authenticated username provided via the REMOTE USER or HTTP REMOTE USER environment variables. In CGI and mod perl based deployments,...

Medium: perl-HTTP-Date

Issue Overview: parsedate -- and str2time, which delegates to it -- used regexes with ambiguous adjacent greedy runs year/clock/timezone digits and timezone/ASCII-timezone letters before a trailing anchor. A valid-looking date prefix followed by a long interior run of digits, letters, or whitespa...

PT-2026-110777

Name of the Vulnerable Software and Affected Versions MONAI versions 0.4.0 through 1.6.0 Description An issue exists where on-path attackers can achieve remote code execution by tampering with SENet pretrained weights fetched over plaintext HTTP. This occurs when the load state dict from url...

PT-2026-110813

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions 12.x prior to 12.1.0 Progress MarkLogic Server versions 11.x prior to 11.3.7 Description Insufficient sanitization of input used by the Query Console file-exploration endpoint allows for HTTP response...

PT-2026-110742

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, a...

Medium: python-urllib3

Issue Overview: urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as i...

EulerOS 2.0 SP11 : perl-HTTP-Tiny (EulerOS-SA-2026-4270)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx...

Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-3163)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3163 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a...

Important: php8.5

Issue Overview: The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined...

httpgrep

Descripción Una herramienta Python rápida y asíncrona que escanea servidores HTTPS y busca cadenas o patrones regex en cuerpos y cabeceras de respuestas HTTP. Acepta hosts individuales, URLs, rangos CIDR, rangos IP o archivos; escanea múltiples puertos por objetivo único, listas separadas por com...

curl: FTP authentication options leak to a cross-origin FTP redirect with unrestricted auth disabled

Summary libcurl 8.22.0 sends values configured with CURLOPTFTPACCOUNT and CURLOPTFTPALTERNATIVETOUSER to a different origin reached through an HTTP-to-FTP redirect even when unrestricted authentication is disabled. I reproduced this after a successful legitimate FTP download by reusing the same...

http-desync-guardian

Resumen HTTP/1.1 experimentó una larga evolución desde 1991 hasta 2014: HTTP/0.9 – 1991 HTTP/1.0 – 1996 HTTP/1.1 RFC 2068 – 1997 RFC 2616 - 1999 RFC 7230 - 2014 Esto significa que existe una variedad de servidores y clientes, los cuales pueden tener diferentes puntos de vista sobre los límites de...

lulzbuster

Descripción Un potente, rápido e inteligente forzador de directorios y archivos HTTPS con múltiples hilos, escrito en C sobre libcurl. Dada una URL objetivo y una lista de palabras, enumera rutas válidas lanzando peticiones HTTP concurrentes e informando las respuestas que parecen aciertos reales...