EUVD-2026-84872

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response

A flaw was found in the Linux kernel's Bluetooth Security Manager Protocol SMP. An attacker could exploit this vulnerability during the Bluetooth pairing process by manipulating authentication requirements. This could lead to the selection of a weaker pairing method than intended, potentially...

CVE-2026-69186

A flaw was found in c-ares, an asynchronous resolver library. A remote attacker can send a specially crafted DNS response that causes the aresdnsparse function to trust attacker-controlled record counts without validating if the response contains enough bytes for the claimed records. This can lea...

CVE-2026-76805 Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor...

SUSE CVE-2026-93561

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...

kernel: Kernel: Remote out-of-bounds write in RDMA/siw

A flaw was found in the Linux kernel's Soft iWARP siw driver. A remote attacker, by sending specially crafted Read Response segments that exceed the requested length, can trigger an out-of-bounds write. This vulnerability can lead to memory corruption, potentially causing a kernel crash or...

nginx: Fix of CVE-2026-1642

CVE-2026-1642: detect premature plain text response from SSL backend...

kernel: Kernel: Remote out-of-bounds write in RDMA/siw

A flaw was found in the Linux kernel's Soft iWARP siw driver. A remote attacker, by sending specially crafted Read Response segments that exceed the requested length, can trigger an out-of-bounds write. This vulnerability can lead to memory corruption, potentially causing a kernel crash or...

DEBIAN-CVE-2026-93711

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...

CVE-2026-93711

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...

UBUNTU-CVE-2026-93711

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...

EUVD-2026-84257

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...

CVE-2026-93711 Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...

CVE-2026-93711 Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...

CVE-2026-93711

Dancer2 versions before 2.2.0 for Perl are vulnerable to CRLF injection because the headers_to_array routine fails to strip CR and LF characters from response header names, though it does strip them from values. Because the name remains intact, it reaches the PSGI server and, if not validated, is...

CVE-2026-93711

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...

CVE-2026-93711 Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...

PT-2026-96325

Name of the Vulnerable Software and Affected Versions Dancer2 versions prior to 2.2.0 Description The headers to array function fails to strip Carriage Return CR and Line Feed LF characters from response header names. While the routine removes these characters from header values, names containing...

Linux Distros Unpatched Vulnerability : CVE-2026-93711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value...

CVE-2026-93711

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...