PT-2026-63547

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that...

Host confusion via authority reinterpretation

Impact guzzlehttp/psr7 improperly interpreted malformed Host header values when constructing request URIs from inbound request data. This issue concerns inbound request parsing and server request construction. It does not require serializing a PSR-7 request, and it is not part of the normal...

Improper Verification of Source of a Communication Channel

Overview sillytavern is a LLM Frontend for Power Users Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel via improper validation of the Host header in inbound HTTP requests. An attacker can gain unauthorized access to sensitive data,...

CVE-2025-59159 SillyTavern Web Interface Vulnerable to DNS Rebinding

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.13.4, the web user interface for SillyTavern is susceptible to DNS rebinding, allowing...

CVE-2022-25374

HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that may capture sensitive data. Fixed in v202202-1...

CVE-2022-25374

HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that may capture sensitive data. Fixed in v202202-1...

PT-2022-17252 · Hashicorp · Hashicorp Terraform Enterprise

Name of the Vulnerable Software and Affected Versions: HashiCorp Terraform Enterprise versions v202112-1 through v202201-2 Description: The issue concerns the logging of inbound HTTP requests in a manner that may capture sensitive data. This could potentially lead to the exposure of sensitive...

Remote Code Execution (RCE)

xenon-commons is vulnerable to remote code execution RCE attacks. These attacks are possible because inbound requests of Content-Type: kryo-octet-stream are deserialized when getBody is called. Using this flaw, unauthenticated users can execute code...

Design/Logic Flaw

IBM WebSphere Application Server WAS 7.0 before 7.0.0.3, and the Feature Pack for Web Services for WAS 6.1 before 6.1.0.25, when a WS-Security policy is established at the operation level, does not properly handle inbound requests that lack a SOAPAction or WS-Addressing Action, which allows remot...