PT-2026-95296

Name of the Vulnerable Software and Affected Versions RESTEasy affected versions not specified Description A flaw exists in the CorsFilter component. When configured to allow all origins using the "" wildcard, the filter reflects the request's Origin header in the Access-Control-Allow-Origin...

PT-2026-95511

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw in the HTTP/2 stack allows a remote attacker to inject prohibited characters, including NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validatio...

PT-2026-95437

Name of the Vulnerable Software and Affected Versions IBM Common Licensing Agent versions 9.0 through 9.0.0.2 IBM ART versions 9.0 through 9.0.0.2 Description Cross-site request forgery allows an attacker to execute malicious and unauthorized actions by transmitting requests from a user that the...

PT-2026-95218

Name of the Vulnerable Software and Affected Versions django-page-cms versions prior to 2.0.14 Description Five admin mutation views in pages/admin/views.py are exempt from Cross-Site Request Forgery CSRF protection. This allows attackers to forge requests that modify page content. Signed-in...

CVE-2026-40532: Direct Request

A direct request 'forced browsing' vulnerability in Wallpaper Path in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information...

CVE-2026-93562: Undefined Security Weakness

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...

Cisco Identity Services Engine (cisco-sa-ise-RADIUS-dos-wR3hYPMw)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the RADIUS feature of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is d...

CVE-2026-63405: Insufficient Verification of Data Authenticity

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied bodymd5 value in the HMAC input but does not calculate the digest of the received request body or compare it...

EulerOS Virtualization 2.11.0 : perl-HTTP-Tiny (EulerOS-SA-2026-3538)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.The...

The vulnerability of the form_fast_setting_wifi_set() function (/goform/fast_setting_wifi_set) in the Tenda A18 router microprogramming software allows a hacker to trigger a service failure.

The vulnerability of the formfastsettingwifiset function /goform/fastsettingwifiset in the Tenda A18 router microprogramming software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST...

The vulnerability of the fromRouteStatic function (/goform/RouteStatic) in the Tenda CX12L Wi-Fi router software allows a hacker to trigger a service failure.

The vulnerability of the fromRouteStatic function /goform/RouteStatic in the Tenda CX12L Wi-Fi router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by sending a specially crafted POST request...

The vulnerability of the fromNatStaticSetting function (/goform/NatStaticSetting) in the Tenda CX12L Wi-Fi router software allows a intruder to trigger a service failure.

The vulnerability of the fromNatStaticSetting function /goform/NatStaticSetting in the Tenda CX12L Wi-Fi router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST request...

The vulnerability of the fromwebExcptypemanFilter() function (/goform/webExcptypemanFilter) in the httpd component of the Tenda F451 router microprogramming system, which allows a hacker to cause a service failure.

The vulnerability of the fromwebExcptypemanFilter function /goform/webExcptypemanFilter in the httpd component of the Tenda F451 router microprogramming system is related to the issue of the operation going beyond the buffer in memory when processing the page parameter. Exploiting this...

The vulnerability of the formTracert() function in Tenda HG3 software allows a hacker to execute arbitrary code.

The vulnerability of the formTracert function in Tenda HG3 router microprogramming software is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code by sending a specially crafted HTTP request...

CVE-2026-93579: Undefined Security Weakness

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

EulerOS Virtualization 2.12.0 : nghttp2 (EulerOS-SA-2026-3655)

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body ont...

PT-2026-95609

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

CVE-2026-11710: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

Cisco Identity Services Engine (cisco-sa-ise-rce-se7bYU57)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must...

Cisco Identity Services Engine (cisco-sa-ise-multi-hrP9jQSQ)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web...