CVE-2026-12005 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a input validation vulnerability in the management interface that allows already privileged attackers to execute additional...

netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...

netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...

netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...

io.quarkus/quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters

A flaw was found in Quarkus. A remote attacker could bypass HTTP path-based authorization policies by using specially crafted encoded semicolons, slashes, or backslashes in HTTP requests. This could allow unauthorized access to protected static resources, leading to information disclosure...

io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing

A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service DoS...

vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects

A flaw was found in Eclipse Vert.x. The DefaultRedirectHandler in vertx-core improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak

A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing t...

Important: Red Hat Security Advisory: Streams for Apache Kafka 3.2.1 release and security update

Streams for Apache Kafka 3.2.1 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests

A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service DoS condition. This vulnerability allows an attacker to disrupt the availability of the affected system...

jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously...

USN-8628-1: libgit2 vulnerabilities

It was discovered that libgit2 incorrectly handled the Git Smart Protocol. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. CVE-2016-10128 It was discovered that libgit2...

USN-8628-1 libgit2 vulnerabilities

It was discovered that libgit2 incorrectly handled the Git Smart Protocol. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. CVE-2016-10128 It was discovered that libgit2...

CVE-2026-73296

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, createmobiledatacollectionserver and createmobileactionserver in ufo/client/mcp/httpservers/mobilemcpserver.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without...

CVE-2018-16844

creationtimestamp| type| source ---|---|--- 2026-08-12 17:00:04+00:00| published-proof-of-concept| Telegram/JXwhaG7Kk3-6UOVRR1APiaO6CTcjXaQDI8i4is7Q1Jd9s 2026-08-12 17:00:04+00:00| seen| Telegram/C6vVyMDURhpvZI0H3EkJps5fsiSVlluQ8gZPOZtlvYIjgA 2026-08-13 00:00:07+00:00| published-proof-of-concept|...

Malicious code in bb-twl-k7x2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b2b4bfa3f9a02df25578aba0d7e80cb0a8daa3c357faca80c11bde6ebf670f8 The package's install and postinstall lifecycle scripts canary.js run unconditionally on npm install and collect installer-side reconnaissance:...

CVE-2026-18536

A flaw was found in Data-Entropy. This component reads remote entropy randomness sources over unencrypted HTTP. An on-path attacker, such as one on an open Wi-Fi network or a compromised internet service provider ISP, can intercept and alter the responses from these sources. This allows the...