Red Hat: CVE-2026-101356: tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

PT-2026-118644

A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this vulnerabili...

PT-2026-118374

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.22 through 11.0.26 Apache Tomcat versions 10.1.55 through 10.1.60 Apache Tomcat versions 9.0.118 through 9.0.122 Description Incorrect object recycling and re-use during HTTP/2 processing of asynchronous servlets ca...

This Week in Spring - October 20th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's almost Halloween! What're you going dressed as, if you celebrate? I'm going dressed as PHP code. Terrifying! We've got a ton of stuff to dive into this week, so let's get right into it. a nice article by Craig Walls call...

PT-2026-118652

An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

PT-2026-119375

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Concurrent Processing versions 12.2.3 through 12.2.15 Description An issue exists in the Request Submission and Scheduling component of Oracle Concurrent Processing. A high privileged attacker with access to the...

PT-2026-118664

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp dns functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP...

Apache jclouds 2.7.0 XML External Entity Injection

Apache jclouds version 2.7.0 contains an XML External Entity injection vulnerability in provider-response parsing that may allow local file disclosure or server-side request forgery when a parsed endpoint is attacker controlled. !/usr/bin/env bash Apache jclouds 2.7.0 XML External Entity XXE...

Totolink X2000R batchupg OS command injection vulnerability

Summary A OS command injection vulnerability exists in the batchupg functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Totolink X2000R boa formIpv6Setup Static Network Configuration Stack-Based Buffer Overflow Vulnerabilities

Summary Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formWsc peerRptPin functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTT...

Totolink X2000R batchupg stack-based buffer overflow vulnerability

Summary A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

Totolink X2000R boa Firmware Update Unsigned Firmware vulnerability

Summary A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this...

Totolink X2000R Mcli stack-based buffer overflow vulnerability

Summary A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerabilit...

PT-2026-118098

Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer to the ' Security Update for ASUS Router Firmware' section ...

Apache Camel 4.22.0 Request Header Echo Suppression Bypass

Apache Camel version 4.22.0 contains a case-sensitive request-header suppression check in camel-platform-http. A proof of concept demonstrates that a lowercased Authorization header can be reflected in the response. https://packetstorm.news/download/236496...

Linux Distros Unpatched Vulnerability : CVE-2026-111748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes...

Apache Tomcat 9.0.118 < 9.0.123 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.123. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.123security-9 advisory. - A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was...

Alibaba Cloud Linux 3 : 0307: libevent (ALINUX3-SA-2026:0307)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0307 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-63382: Libevent is an event...

Linux Distros Unpatched Vulnerability : CVE-2026-111063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An...

PT-2026-118341

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...