110001 matches found
Moderate: nghttp2 security update
libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 For more details about the security issues,...
PT-2026-73430
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and pass...
PT-2026-73396
A flaw in Node.js HTTP/2 handling allows nghttp2 session mem send to be called re-entrantly while nghttp2 session mem recv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
PT-2026-73412
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...
PT-2026-73394
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...
ROS-20260817-73-0217
The vulnerability in Ruby is related to uncontrolled resource consumption due to filtering and reducing data to unsafe values during the processing of HTTP headers. Exploiting this vulnerability can allow an attacker to cause service failures, provided that the default configurations of...
ALSA-2026:55804 Moderate: nghttp2 security update
libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 For more details about the security issues,...
PT-2026-73265
Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...
Important: nodejs22
Issue Overview: brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attacker who passes a crafted string to expand, directly or transitively, can cause significant...
PT-2026-73404
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...
CVE-2026-68005
An issue in ACME minihttpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handlerequest function...
CVE-2026-68005
An issue in ACME minihttpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handlerequest function...
EUVD-2026-60449
An issue in ACME minihttpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handlerequest function...
CVE-2026-68005
An issue in ACME minihttpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handlerequest function...
nginx: Multiple Vulnerabilities
Background nginx is a robust, small, and high performance HTTP and reverse proxy server. Description Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround...
MiracleLinux 9 : dotnet8.0-8.0.129-1.el9_8.ML.1 (AXSA:2026-1546:15)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1546:15 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...
.NET: .NET Core: .NET Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-73046 SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/ surface, accepts the workspace access code Conf.AccessAuthCode as the Basic Auth password but never consults the...
CVE-2026-73046
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/ surface, accepts the workspace access code Conf.AccessAuthCode as the Basic Auth password but never consults the...
DEBIAN-CVE-2026-74468
In the Linux kernel, the following vulnerability has been resolved: gpio: pch: use rawspinlockt for the register lock pchirqtype is registered as the irqchip .irqsettype callback and takes chip-spinlock with spinlockirqsave. This callback is reached from setupirq - irqsettrigger - chip-irqsettype...