CVE-2026-86414

An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...

CVE-2026-77114 Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting

The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dgthumberwebhook' Action Request Body in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CLEANSTART-2026-BM42059 HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023

Security vulnerability affects the openjdk21 package. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

CLEANSTART-2026-ZY41765 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-GY77159 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details...

CLEANSTART-2026-BA60559 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via improper handling of non-finite numeric values

A flaw was found in kin-openapi. A remote, unauthenticated attacker can exploit this vulnerability by submitting a specially crafted YAML request containing non-finite numeric values, such as Not-a-Number or infinity, to an endpoint with numeric constraints. Because the validation process fails t...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in request decoding

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending specially crafted HTTP requests containing specific array query parameters or form-encoded data. Because the request decoder fails to properly validate certain array schemas before...

PT-2026-113600

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings dialog function building the url template placeholder from a sanitize text field-filtered $ SERVER'REQUEST URI' on archive pages a...

PT-2026-113617

The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg thumber webhook' Action Request Body in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

Hyperledger FireFly Core 1.5.0 Server-Side Request Forgery

Hyperledger FireFly Core version 1.5.0 and prior versions with the webhooks event transport contain a server-side request forgery vulnerability. The proof of concept creates a webhook subscription with a supplied URL and broadcasts a message to trigger the FireFly node request...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-71301): Gitea -- multiple vulnerabilities

Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with only Wiki access to a private repository can submit a markup preview request and retrieve a private pull request's title and state icon despit...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-70406): Gitea -- multiple vulnerabilities

Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...

CVE-2026-0317: Improper Check for Unusual or Exceptional Conditions

A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a denial of service DoS condition by sending a specially crafted API request. The security risk posed by this issue is significantly minimized by...

CVE-2026-67418: Improper Validation of Syntactic Correctness of Input

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmqmqtt/src/rabbitmqttpacket.erl accepts Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. An authenticated...

CVE-2026-89310: Improper Neutralization of Special Elements used in an SQL Command

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...

PT-2026-114120

TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...

PT-2026-114355

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A flaw exists in the ngx http v3 module module. When HTTP/3 is used in conjunction with the proxy request buffering directive set to on, a...

CVE-2026-103930: Improper Neutralization of CRLF Sequences in HTTP Headers

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline without the detail::encodepath protection used by the ordinary buffered request path. Raw carriage-return and...

Linux Distros Unpatched Vulnerability : CVE-2026-107698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx...