CVE-2026-74848 Apache APISIX: Cross-user response poisoning in serverless plugins

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...

CVE-2026-74848 Apache APISIX: Cross-user response poisoning in serverless plugins

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...

CVE-2026-74848 Apache APISIX: Cross-user response poisoning in serverless plugins

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...

CVE-2026-74848

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...

EUVD-2026-66958

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...

CVE-2026-74848

Apache APISIX is vulnerable to an HTTP Request/Response Smuggling flaw in serverless-plugin routes , allowing an unauthenticated network attacker to cause other clients to receive attacker-chosen or cross-user responses. The issue affects versions 2.12.0 through 3.17.0 and is fixed in version 3.1...

UBUNTU-CVE-2026-47889

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

EUVD-2026-66857

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

PT-2026-82448

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.12.0 through 3.17.0 Description An inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, occurs on serverless-plugin routes. This allows an attacker to manipulate the request stream so...

PT-2026-82768

Name of the Vulnerable Software and Affected Versions Wazuh versions prior to 4.14.7 Description The ip-customblock active response script contains a path traversal flaw allowing an attacker to create or delete arbitrary files on the filesystem with root privileges. The issue occurs because the...

PT-2026-82769

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key response with fewer...

PT-2026-82795

Name of the Vulnerable Software and Affected Versions cpp-httplib versions prior to 0.50.0 Description The chunked-response trailer output path writes trailer header names and values directly to the socket without validation. This lack of checks for carriage return CR and line feed LF sequences...

PT-2026-82770

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing...

TencentOS Server 3: nghttp2 (TSSA-2026:0905)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0905 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2026-59314: Improper Neutralization of CRLF Sequences in HTTP Headers

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...

CVE-2026-74848: Inconsistent Interpretation of HTTP Requests

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...

PT-2026-82718

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28 Spring Framework versions 6.0.0 through 6.0.30 Spring Framework versions 5.3.0 through 5.3.49 Spring...

TencentOS Server 3: nodejs:22 (TSSA-2026:0931)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0931 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-47861 UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 -...

CVE-2026-47861

Spring Integration UDP inbound adapter contains a flaw where the adapter sends an acknowledgment (ack) to a host:port parsed from the packet body, even when acknowledge=false is configured. An unauthenticated remote attacker who can send a single UDP packet to the adapter can cause the server to ...