PT-2026-111314

Cross-Site Request Forgery CSRF vulnerability in ThemeGrill User Registration user-registration allows Cross Site Request Forgery.This issue affects User Registration: from n/a through 5.2.8...

PT-2026-112910

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.App.Runtime.linux-arm versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 8.0.0 through 8.0.31...

CVE-2026-88092: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

CVE-2026-88092: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

CVE-2026-88092

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

mod_wsgi -- race condition at process start can leak request context between requests

Graham Dumpleton reports: A race condition at process startup could let two threads be handed the same per-thread record, because records were allocated from an Apache memory pool shared by every thread without a lock. Threads sharing a record also shared the modwsgi.threadid value and, for named...

p5-Plack -- Multiple vulnerabilities

Plack project reports: SECURITY Fix memory leak of every request env in Plack::Middleware::Recursive CVE-2026-110333 Plack::Request::Upload-basename never returns '', '.' or '..' CVE-2026-110332 Plack::App::URLMap matches SERVERPORT literally when stripping it from Host CVE-2026-110335 BUG FIXES...

SUSE SLES15 Security Update : squid (SUSE-SU-2026:4621-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4621-1 advisory. - CVE-2026-32748: denial of service in ICP Request handling bsc1260453. - CVE-2026-33515: out of bounds read in ICP message handlin...

PT-2026-111524

Name of the Vulnerable Software and Affected Versions fastify versions 5.12.2 through 5.12.5 Description A routine used to lowercase header names declared in a route schema fails to lowercase enum or const header names nested within a propertyNames subschema. This causes header allow-lists or...

PT-2026-112289

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.App.Runtime.linux-arm versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions...

CVE-2026-88092: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

Microsoft ASP.NET: CVE-2026-70188: ASP.NET Core Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

MikroTik RouterOS Before 7.24 Integer Underflow

MikroTik RouterOS versions before 7.24 contain a pre-authentication integer underflow in HTTP request body handling that can cause a web management service denial of service and may allow code execution...

PT-2026-122255

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

Red Hat: CVE-2026-61642: squid: squid: Request Smuggling in HTTP Transfer-Encoding

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

CVE-2026-107370: Use of GET Request Method With Sensitive Query Strings

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters...

CVE-2026-110130: Authentication Bypass Using an Alternate Path or Channel

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...

CVE-2026-61642: Inconsistent Interpretation of HTTP Requests

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

CVE-2026-61642: Inconsistent Interpretation of HTTP Requests

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

PT-2026-111692

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit, Extra::edit, Leaves::delete,...