CVE-2026-86350: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from...

PT-2026-97275

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment...

PT-2026-97662

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs. The submodule did not...

Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs. The submodule did not...

PT-2026-97287

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Pushed Authorization Request PAR implementation. When the silent authentication path prompt=none is used, the authorization process may skip specific steps for users who...

PT-2026-97687

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.11 through 19.2.6 GitLab CE/EE versions 19.3 through 19.3.2 GitLab CE/EE versions 19.4 Description An issue exists where improper sanitization of path components in the merge request diff viewer could allow an...

CVE-2026-78437: Incomplete Cleanup

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially depends on timing cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are...

The vulnerability of the Goproxy proxy server’s HTTP request processing module allows attackers to bypass existing security mechanisms and gain unauthorized access to protected information.

The vulnerability of the Goproxy proxy server’s HTTP request processing module lies in the ability to bypass authentication by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent existing security mechanisms and gain unauthorized access to...

The vulnerability of the .NET software platform and the Visual Studio Code editor, related to deficiencies in HTTP request processing, allows attackers to disclose sensitive information.

The vulnerability of the .NET software platform and the code editor Visual Studio Code is related to deficiencies in HTTP request processing. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

GitLab 19.1 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-92530)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an...

Linux Distros Unpatched Vulnerability : CVE-2026-94108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on...

CVE-2026-18066

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery...

CVE-2026-18066 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery...

CVE-2026-18066 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery...

CVE-2026-18066

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by vulnerabilities that could allow a local attacker to obtain sensitive information and trigger unauthorized actions. This is caused by server-side request forgery . No specific exploit details or remediation steps are prov...

CVE-2026-95813

e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails urlfor in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query...

CVE-2026-76909

Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML...

CVE-2026-75101 Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...

CVE-2026-75101

An authorization bypass vulnerability exists in GitHub Enterprise Server (versions prior to 3.22) due to a repository name collision flaw. Access tokens for raw pull request diffs and patches were incorrectly scoped to the repository name and pull request number rather than a globally unique iden...

GHSA-4GHV-53CQ-7WP3 Home Assistant: mDNS Server-Side Request Forgery

Summary Home Assistant Green is vulnerable to a Server-Side Request Forgery SSRF via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal servic...