150202 matches found
CVE-2026-108102: Out-of-bounds Read
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsevolumemeasurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags...
PT-2026-108928
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs pfcp parse volume measurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flag...
WS-2026-0166
vllm 0.9.2 - 0.23.0: P2pNcclConnector parses a host:port from the client-controlled X-Request-Id header and connects to it over ZMQ/NCCL, letting an API caller exfiltrate KV-cache tensors to an attacker host GHSA-vfp2-c8pq-v6h6...
PT-2026-109152
Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network...
PT-2026-108870
Name of the Vulnerable Software and Affected Versions GDPR Data Request Form versions prior to 1.7.2 Description The plugin lacks Cross-Site Request Forgery CSRF protection—a type of attack that forces an authenticated user to execute unwanted actions—when updating specific settings. This allows ...
Apache CXF 4.0.3 Aegis DataBinding Server-Side Request Forgery
Apache CXF versions before 4.0.4, 3.6.3, and 3.5.8 using Aegis DataBinding contain a server-side request forgery vulnerability. The included proof of concept demonstrates processing an XOP Include URL, which can expose local or internal resources. https://packetstorm.news/download/235030...
PT-2026-109148
Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server...
Progress Telerik Fiddler Classic < 6.0.20262.10021 Multiple Vulnerabilities
The version of Progress Telerik Fiddler Classic installed on the remote Windows host is prior to 6.0.20262.10021. It is, therefore, affected by multiple vulnerabilities: - An insufficient integrity check on external helper tools allows a local low-privileged attacker to replace a helper executabl...
Cisco NX-OS Software NX-API RCE (cisco-sa-napi-rce-r2shwu2j)
According to its self-reported version, Cisco UCS Manager Software is affected by a vulnerability. - A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS...
CVE-2026-94439
A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...
CVE-2026-107291
A flaw was found in Pydantic AI. When OpenTelemetry instrumentation is configured to exclude content, sensitive agent data is still exported to the telemetry backend through exception details, error status descriptions, and model request parameters. An attacker or unauthorized user with read acce...
shadowd
Logotipo Shadow Daemon es un cortafuegos de aplicaciones web que intercepta las peticiones a nivel de aplicación. Este repositorio contiene el componente principal de Shadow Daemon que maneja el análisis y almacenamiento de peticiones. Documentación Para la documentación completa, consulte...
AZL-108239 CVE-2026-94439 affecting package golang 1.27.3-1
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...
AZL-108468 CVE-2026-94439 affecting package python-tensorboard 2.16.2-6
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...
AZL-108222 CVE-2026-94439 affecting package golang 1.26.10-1
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...
ALPINE-CVE-2026-94439
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...
CVE-2026-94439
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...
DEBIAN-CVE-2026-94439
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...
AZL-108543 CVE-2026-94439 affecting package tensorflow 2.16.1-11
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...
AZL-107853 CVE-2026-56866 affecting package python-tensorboard 2.16.2-6
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...