CVE-2026-1758: Session Fixation

Session fixation vulnerability in Secomea GateManager webserver module allows Session Fixation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above...

CVE-2026-83280: Uncontrolled Resource Consumption

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

PT-2026-91924

Session fixation vulnerability in Secomea GateManager webserver module allows Session Fixation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above...

CVE-2026-87289: Uncontrolled Resource Consumption

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-static-content. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attac...

CVE-2026-90668

A flaw was found in UnrealIRCd. The webserver component does not properly limit the number of HTTP request headers. A remote attacker can exploit this vulnerability by sending an HTTP request with an excessive number of headers, leading to memory consumption and an unresponsive server. This can...

CVE-2026-90668

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

Rockwell Automation ArmorStart LT

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could result in a loss of webserver availability or allow an attacker to inject malicious scripts that will be executed when other users access the affected page. 2. RECOMMENDED PRACTICES CISA recommends users take defensive...

CVE-2026-45273: Missing Authorization

MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any...

Linux Distros Unpatched Vulnerability : CVE-2026-23930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend...

Linux Distros Unpatched Vulnerability : CVE-2026-23934

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend...

DEBIAN-CVE-2026-23930

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

DEBIAN-CVE-2026-23934

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...

CVE-2026-23934

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...

EUVD-2026-60738

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...

CVE-2026-23930

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

CVE-2026-23930

CVE-2026-23930 affects the Zabbix monitoring platform. An unauthenticated attacker can send specifically crafted requests to the Frontend popup.testtriggerexpr action, causing disproportionate CPU load on the Frontend webserver and leading to a potential denial of service . The NVD rates the vuln...

EUVD-2026-53353

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses FILE:path content directives from uploaded Structured Text .st program files and writes the referenced content to os.path.join'./core', filepath with no validation that filepath stays within the ./core directory. A crafted ....

CVE-2026-71268: Improper Limitation of a Pathname to a Restricted Directory

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses directives from uploaded Structured Text .st program files and writes the referenced content to with no validation that filepath stays within the ./core directory. A path-validation function, validatefilepath, exists elsewhe...

Debian dla-4706 : ruby-rack - security update

The remote Debian 11 / 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4706 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4706-1 [email protected]...

Siemens SIMATIC Observable Discrepancy (CVE-2023-37482)

The webserver of several SIMATIC products is affected by a user enumeration vulnerability that could allow an unauthenticated remote attacker to identify valid usernames. The login functionality of the web server in affected devices does not normalize the response times of login attempts. An...