Linux Distros Unpatched Vulnerability : CVE-2026-93710

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A ho...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-waitress (UTSA-2026-054067)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054067 advisory. Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: dovecot (UTSA-2026-090088)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090088 advisory. In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled. Tenable has extracted the...

CVE-2026-61743 Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeRequest.js calls validateOutboundUrl to resolve and validate a target hostname, but request-promise performs a separate DNS...

EUVD-2026-84211

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeRequest.js calls validateOutboundUrl to resolve and validate a target hostname, but request-promise performs a separate DNS...

CVE-2026-73547 Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's extauthz filter assumes that a request contains a :path pseudoheader when applying queryparameterstoset or queryparameterstoremove from an authorization...

EUVD-2026-84110

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's extauthz filter assumes that a request contains a :path pseudoheader when applying queryparameterstoset or queryparameterstoremove from an authorization...

EUVD-2026-84103

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete...

Malicious code in @uh-platform/domain-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fa27cef146dec157eaf78519d56ff2ef696f32e99746cdabea9e30be7c03b96 Package @uh-platform/[email protected] is a scoped placeholder with an empty author, generic description, and no real functionality. Its...

CVE-2026-94411 jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege...

SUSE CVE-2026-59832

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticat...

SUSE CVE-2026-88012

Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream...

EUVD-2026-84007

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLEDRAWIOPROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in Utils.sanitizeUrl using one DN...

io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing

A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...

io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

io.netty/netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling

A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass Transfer-Encoding header validation by splitting the Transfer-Encoding field across multiple headers, with the last field containing a non-final transfer coding like gzip or deflate. This bypass ca...

io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...

io.netty/netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...

io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...