CVE-2026-78012: Stack-based Buffer Overflow

An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Class 3 explicit-message request to exceed the application-side receive buffer without generating an error or warning. The result could be memory corruption, a device crash, or a potential remote attack vector without t...

CVE-2026-73812: Inconsistent Interpretation of HTTP Requests

httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...

CVE-2026-73276: Inconsistent Interpretation of HTTP Requests

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7,...

CVE-2026-66357: Inconsistent Interpretation of HTTP Requests

httpd has never implemented obs-fold RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue...

CVE-2026-19472: Allocation of Resources Without Limits or Throttling

A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability...

PT-2026-89916

httpd has never implemented obs-fold RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue...

ROS-20260901-73-0026

The vulnerability in php-phpseclib is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to perform SSRF attacks remotely...

CVE-2026-51742: Improper Access Control

Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51742

Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-69410

llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service std::badalloc and HTTP 500 via a negative topn value in a POST request to /rerank...

PT-2026-84203

Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-84481: Exposure of Sensitive Information to an Unauthorized Actor

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.ph...

CVE-2026-51741

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the clearDiagnosisLog function. This vulnerability allows unauthenticated attackers to erase diagnosis logs by sending a specially crafted POST request to the /cgi-...

ASB-A-471796626

In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-84072

Name of the Vulnerable Software and Affected Versions Node.js version 22 Node.js version 24 Node.js version 26 Description A flaw in the HTTP client can cause request desynchronization for forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the...

PT-2026-89926

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4...

CVE-2026-83744: Server-Side Request Forgery (SSRF)

A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Services/Pdf/Purify.php of the component invoices Endpoint. The manipulation of the argument notes leads to server-side request forger...

PT-2026-89925

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7,...

PT-2026-84266

Name of the Vulnerable Software and Affected Versions OTP versions 17.0 through 27.3.4.16 OTP versions 28.0 through 28.5.0.5 OTP versions 29.0 through 29.0.5 inets versions 5.10 through 9.3.2.6 inets versions 9.4 through 9.6.2.2 inets versions 9.7 through 9.7.1 Description The check header/3...

CVE-2026-74835: Allocation of Resources Without Limits or Throttling

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4...