PT-2026-120884

A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been...

camel-netty-http Apache Camel Bypass Security

The vulnerability of the camel-netty-http component of the Apache Camel framework is related to deficiencies in the mechanism for handling registry-dependent data. Exploiting this vulnerability could allow a malicious actor to bypass existing security measures remotely...

Cisco TelePresence Video Communication Server (VCS) Expressway: CVE-2026-76435: Cisco Expressway Series Information Disclosure Vulnerability

A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access MRA provisioning. An attacker could...

PT-2026-120568

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal port, the HTTP built-in service exemption on internal port can be abused to bypass authentication entirely. VerifyHttpRequest returns true without checking any credential when a built-in service is requested on interna...

CVE-2025-31699: Inconsistent Interpretation of HTTP Requests

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body dat...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libwebsockets (UTSA-2026-142308)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142308 advisory. libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra...

Linux Distros Unpatched Vulnerability : CVE-2026-78660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. Howeve...

RockyLinux 10 : golang (RLSA-2026:86093)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:86093 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multipl...

Atlassian Confluence 7.11.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104518)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104518 advisory. - Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset Thi...

AlmaLinux 10 : golang (ALSA-2026:86093)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:86093 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple...

Linux Distros Unpatched Vulnerability : CVE-2026-78663

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread...

Oracle HTTP Server 12c (October 2026 CPU)

The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: OSSL Module. Supported versions that are affected are...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Squid vulnerabilities (USN-8941-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8941-1 advisory. It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker cou...

Linux Distros Unpatched Vulnerability : CVE-2026-101356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response...

Oracle HTTP Server 14c (October 2026 CPU)

The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: OSSL Module. Supported versions that are affected are...

Linux Distros Unpatched Vulnerability : CVE-2026-78659

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-gunicorn (UTSA-2026-142339)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142339 advisory. Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling HRS vulnerabilities. By crafting requests with conflicting...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-142315)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142315 advisory. A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the soupmessagenew function, could inject arbitrary headers and additional...

Oracle Access Manager (October 2026 CPU)

The 12.2.1.4.0 and 14.1.2.1.0 versions of Access Manager installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Support...

RHEL 9 : golang (RHSA-2026:86196)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86196 advisory. The golang packages provide the Go programming language compiler. Security Fixes: net/http: golang: golang: Denial of Service via crafted...