CVE-2026-78682 NLTK before 3.10.3 SSRF Protection Bypass via Proxy

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen and callers nltk.data.load, nltk.downloader.Downloader.index/download when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables...

CVE-2026-78682

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen and callers nltk.data.load, nltk.downloader.Downloader.index/download when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables...

CVE-2026-78682

NLTK before 3.10.3 is affected by a server-side request forgery (SSRF) vulnerability in nltk.pathsec.urlopen and its callers (nltk.data.load, nltk.downloader.Downloader.index/download). The root cause is that when an HTTP proxy is configured, proxy-handler inheritance disables the safe HTTP/HTTPS...

EUVD-2026-65228

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen and callers nltk.data.load, nltk.downloader.Downloader.index/download when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables...

PT-2026-81887

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.0 through 7.0.109...

nginx:1.26 security update

1.26.3-9.0.1.3 - Require oracle-indexhtml 2:1.26.3-13 - Fixes CVE-2026-56434 and CVE-2026-60005 2:1.26.3-12 - Resolves: RHEL-191774 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes 2:1.26.3-11 - nginx:1.26/nginx: HTTP/2: Remote Denial of Service via compression bomb and...

ALSA-2026:59347 Low: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 For more details about the securit...

RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:59136)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59136 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

PT-2026-81889

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.39 through 9.0.120 Apache Tomcat versions 8.5.59 through 8.5.100 Description An uncontrolled resource consumption issu...

nginx:1.24 security update

1.24.0-3.4.0.1 - Remove Red Hat references Orabug: 29498217 1:1.24.0-3.4 - Resolves: RHEL-217957 - nginx:1.24/nginx: NGINX: Memory disclosure and denial of service in ngxhttpslicemodule CVE-2026-60005 - Resolves: RHEL-219309 - nginx:1.24/nginx: NGINX: Heap buffer over-read allows memory...

nginx security update

1.26.3-6.0.1.el102.6 - Reference oracle-indexhtml within Requires Orabug: 33802044 2:1.26.3-6.6 - Resolves: RHEL-219313 - nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 - Resolves: RHEL-217956 - nginx: NGINX: Memory disclosure and denial of...

EulerOS Virtualization 2.13.0 : httpd (EulerOS-SA-2026-3215)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.This issue affects Apache HTTP Server: through...

EulerOS Virtualization 2.13.1 : httpd (EulerOS-SA-2026-3175)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.This issue affects Apache HTTP Server: through...

Low: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 For more details about the securit...

Moderate: mod_http2 security, bug fix, and enhancement update

The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: httpd: modhttp2: Apache HTTP Server modhttp2: Use After Free vulnerability allows arbitrary code execution or denial of service. CVE-2026-48913 httpd: Apache HTTP Server:...

RHEL 9 : mod_http2 (RHSA-2026:59387)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:59387 advisory. The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: httpd:...

Oracle Linux 10 : nginx (ELSA-2026-59220)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-59220 advisory. - Resolves: RHEL-219313 - nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 - Resolves: RHEL-217956 ...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service, HTTP Response and Request Smuggling vulnerabilities when servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Vulnerability Details...

CVE-2021-41773---Apache-Path-Traversal---RCE

CVE-2021-41773 — Apache Path Traversal e RCE Compito di tirocinio: ITSOLERA PVT LTD — Sicurezza Offensiva Tirocinante: Areeba Zehra Jafri Team Leader: Muhammad Ahsan Ayaz Data: 18 marzo 2026 Panoramica Ricerca e sfruttamento di CVE-2021-41773 — vulnerabilità di Path Traversal ed esecuzione remota...

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...