EUVD-2026-52563

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-58044

CVE-2026-58044 describes a flaw in the Node.js HTTP client that can cause request desynchronization for Node.js-based forwarding proxies. The problem arises because Node.js may omit headers beyond maxHeadersCount/maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, yet contin...

EUVD-2026-52516

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2026-48331

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2026-67617

CVE-2026-67617 (Microweber CMS 2.0.20) describes a stored XSS in the content tagging system. An admin-authenticated attacker can inject arbitrary JavaScript by submitting payloads to the tag_names parameter of the GET /api/save_content_admin endpoint. The vulnerability allegedly bypasses three sa...

CVE-2026-69243

Affected software: AIOHTTP (async HTTP client/server for asyncio and Python). Vulnerability: HTTP request smuggling in the server-side WebSocket upgrade path due to the HTTP parser handling a WebSocket upgrade request with a body in a way that may allow trailing bytes to be misinterpreted as upgr...

EUVD-2026-52436

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

CVE-2026-68981

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-66296

Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...

CVE-2026-68981

The CVE-2026-68981 issue affects Apache NiFi versions 1.5.0 through 2.10.0, where gzip-encoded HTTP requests to the REST API are processed via a Jersey encoding filter. A configurable maximum is enforced on the compressed payload rather than the decompressed output, which could allow a malicious ...

EUVD-2026-50568

undici vulnerable to CRLF Injection via blob-like body 'type' property...

CVE-2026-66296 Reflected XSS in oaskit's default HTML error handler

Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...

CVE-2026-66296 Reflected XSS in oaskit's default HTML error handler

Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...

EUVD-2026-52407

Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...

CVE-2026-68945

A flaw was found in Angular's HttpTransferCache component. This component, used for caching HTTP requests during server-side rendering, incorrectly generates cache keys when repeated request parameters are present, causing semantically different requests to share the same cache key. This cache-ke...

CVE-2026-68945

CVE-2026-68945 affects Angular’s HttpTransferCache in HttpClient. Before 20.3.27, 21.2.19, and 22.0.2, comma-joining repeated request parameters caused semantically distinct requests to share a transfer-cache key, leading to reuse of a wrong backend response and potential state poisoning. The iss...

EUVD-2026-52343

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same...

CVE-2026-68945 Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same...

EUVD-2026-52339

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall...