2026

The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacke

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification.

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apa

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of serv

The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This i

The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0

The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apa

The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This is

The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issu

The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apach

The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue aff

The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects

The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This is

Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8

Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This i

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue

The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue af

Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8

Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affe

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects

Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoi

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A re

A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group m

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discov

The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Au

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the n

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_

In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exe

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue af

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue af

Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting H

Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects A

Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. Thi

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in al

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in a

Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. Thi

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic S

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 th

An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same n

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handl

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server.

Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: fr

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allow