|
cve-2026-56746
|
io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header |
HIGH
|
7.5
|
N/A
|
cvelistv5 |
2026-09-01 |
|
cve-2026-56745
|
SUSE CVE CVE-2026-56745 |
HIGH
|
7.5
|
N/A
|
cvelistv5 |
2026-08-05 |
|
cve-2026-56722
|
Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI |
MEDIUM
|
6.3
|
N/A
|
cvelistv5 |
2026-07-29 |
|
cve-2026-55950
|
SUSE CVE CVE-2026-55950 |
HIGH
|
7.5
|
N/A
|
cvelistv5 |
2026-09-02 |
|
cve-2026-55833
|
netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification |
HIGH
|
7.5
|
N/A
|
cvelistv5 |
2026-09-01 |
|
cve-2026-55831
|
SUSE CVE CVE-2026-55831 |
HIGH
|
7.5
|
N/A
|
cvelistv5 |
2026-08-05 |
|
cve-2026-55767
|
guzzlehttp/guzzle: Guzzle: Cookie injection and session fixation due to improper domain validation |
HIGH
|
7.2
|
N/A
|
cvelistv5 |
2026-06-28 |
|
cve-2026-55766
|
guzzlehttp/psr7: guzzlehttp/psr7: Information disclosure due to improper handling of CR/LF characters in HTTP start-line fields |
MEDIUM
|
4.8
|
N/A
|
cvelistv5 |
2026-06-28 |
|
cve-2026-55568
|
guzzlehttp/guzzle: Guzzle: Information disclosure via cleartext proxy communication |
MEDIUM
|
5.9
|
N/A
|
cvelistv5 |
2026-06-28 |
|
cve-2026-55555
|
Dompdf: File existence oracle via font-face stylesheet declaration |
LOW
|
2.3
|
N/A
|
cvelistv5 |
2026-07-28 |
|
cve-2026-55554
|
Dompdf: Chroot Validation Bypass |
LOW
|
2.3
|
N/A
|
cvelistv5 |
2026-07-29 |
|
cve-2026-54887
|
DTLS server cookie bypass during startup window due to empty initial cookie secret |
MEDIUM
|
6.3
|
N/A
|
cvelistv5 |
2026-07-24 |
|
cve-2026-54517
|
jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application |
MEDIUM
|
5.3
|
N/A
|
cvelistv5 |
2026-07-14 |
|
cve-2026-54516
|
jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties |
MEDIUM
|
5.3
|
N/A
|
cvelistv5 |
2026-07-14 |
|
cve-2026-54514
|
jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution |
MEDIUM
|
5.3
|
N/A
|
cvelistv5 |
2026-07-13 |
|
cve-2026-53422
|
erlang: ssh: Erlang OTP ssh: Information disclosure via SFTP REALPATH handler |
MEDIUM
|
4.3
|
N/A
|
cvelistv5 |
2026-08-06 |
|
cve-2026-50734
|
Apache ActiveMQ Client: Apache ActiveMQ: Apache ActiveMQ All: Apache ActiveMQ: Denial of Service via crafted WireFormatInfo frame |
HIGH
|
7.5
|
N/A
|
cvelistv5 |
2026-07-31 |
|
cve-2026-50020
|
netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder |
MEDIUM
|
5.3
|
N/A
|
cvelistv5 |
2026-08-04 |
|
cve-2026-50010
|
netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass |
HIGH
|
7.5
|
N/A
|
cvelistv5 |
2026-09-03 |
|
cve-2026-49844
|
org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values |
MEDIUM
|
5.9
|
N/A
|
cvelistv5 |
2026-07-29 |
|
cve-2026-49760
|
SUSE CVE CVE-2026-49760 |
MEDIUM
|
5.9
|
N/A
|
cvelistv5 |
2026-08-21 |
|
cve-2026-49284
|
SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo` |
HIGH
|
7.1
|
N/A
|
cvelistv5 |
2026-07-20 |
|
cve-2026-49214
|
guzzlehttp/psr7: `guzzlehttp/psr7`: Request Smuggling and Cache Poisoning via HTTP Header Injection |
MEDIUM
|
5.3
|
N/A
|
cvelistv5 |
2026-06-28 |
|
cve-2026-48998
|
guzzlehttp/psr7: guzzlehttp/psr7: Information disclosure via improper Host header validation |
MEDIUM
|
5.3
|
N/A
|
cvelistv5 |
2026-06-28 |
|
cve-2026-48856
|
SUSE CVE CVE-2026-48856 |
MEDIUM
|
6.5
|
N/A
|
cvelistv5 |
2026-09-18 |
|
cve-2026-48855
|
erlang: Erlang OTP ssh: Information disclosure via symlink resolution in SFTP |
MEDIUM
|
4.3
|
N/A
|
cvelistv5 |
2026-06-28 |
|
cve-2026-47691
|
io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records |
HIGH
|
8.7
|
N/A
|
cvelistv5 |
2026-09-01 |
|
cve-2026-47065
|
mina: mina: Arbitrary Code Execution via Deserialization Bypass |
CRITICAL
|
9.8
|
N/A
|
cvelistv5 |
2026-08-26 |
|
cve-2026-45674
|
netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation |
HIGH
|
8.7
|
N/A
|
cvelistv5 |
2026-09-03 |
|
cve-2026-45673
|
netty-resolver-dns: Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs |
MEDIUM
|
6.8
|
N/A
|
cvelistv5 |
2026-08-04 |
ndaal KEV