CVE-2026-55994

camel-iggy User-Header Injection Reproducer CVE-2026-55994 This project demonstrates a message-header injection in Apache Camel's camel-iggy component, tracked as CVE-2026-55994. The Iggy consumer copies an inbound message's user-headers onto the Camel Exchange without anyHeaderFilterStrategy, so...

EUVD-2026-90966

HCL AION is affected by a vulnerability in which the Content-Security-Policy CSP HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting XSS by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header...

CVE-2026-21833 HCL AION is susceptible to a Missing "Content-Security-Policy" header Vulnerability (CVE-2026-21833)

HCL AION is affected by a vulnerability in which the Content-Security-Policy CSP HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting XSS by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header...

Linux Distros Unpatched Vulnerability : CVE-2026-84445

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to...

PT-2026-82274

In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference or access to invalid memory while processing the frame, causing the process to crash...

GHSA-VVWM-3J43-7PFM Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode t...

Linux Distros Unpatched Vulnerability : CVE-2026-74701

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/openvswitch: check Ethernet header length in keyextract When a packet arrives on an ARPHRDNONE device e.g. TUN, ovsflowkeyextract trusts the user-provided...

PT-2026-79459

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http servers/linux mcp server.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An...

CVE-2026-56586

Technical details about CVE-2026-56586 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2026-56586 HCL IEM was affected with X-Content-Type-Options Header Missing

HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data...

EUVD-2026-46277

HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce unauthorized user actions...

aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...

CVE-2024-23569

HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header...

PT-2026-60755

Name of the Vulnerable Software and Affected Versions HCL Aftermarket EPC affected versions not specified Description The server is not configured with the X-XSS-Protection header, which is a security feature designed to stop pages from loading when they detect reflected cross-site scripting XSS...

CVE-2026-35145

HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Security HSTS policy within its responses, which could allow a remote attacker to downgrade the communication channel to an unencrypted...

CVE-2026-12382 Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...

CVE-2026-59950: Origin Validation Error

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. Prior to 1.28.1, the deprecated mcp.server.websocket.websocketserver transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restric...

CVE-2026-47220

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTEDSERVERNAMEX:Y% is used in log format and host related options is specified, like HOSTFIRST, SNIFIRST, it's possible to crash Envoy when the specified host...

GO-2026-5191 nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store in github.com/juev/nebula-mesh

nebula-mesh: POST /api/v1/hosts/id/mobile-bundle response lacks Cache-Control: no-store in github.com/juev/nebula-mesh...

CVE-2025-31984

HCL BigFix Service Management SM is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly...