cve.li

Recent

CVE-2026-105816CWE-22

Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots

Published 2026-10-07 by HashiCorp

CVE-2026-107285CWE-319CWE-522

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

Published 2026-10-07 by GitHub_M

CVE-2026-107284CWE-345CWE-670

AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check

Published 2026-10-07 by GitHub_M

CVE-2026-107283CWE-338

AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

Published 2026-10-07 by GitHub_M

CVE-2026-107282CWE-319CWE-441CWE-522

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

Published 2026-10-07 by GitHub_M

CVE-2026-105818CWE-345

Vault PKI ACME Issues Certificate With Unvalidated SANs

Published 2026-10-07 by HashiCorp

CVE-2026-107281CWE-346CWE-863

AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities

Published 2026-10-07 by GitHub_M

CVE-2026-107280CWE-1275

AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

Published 2026-10-07 by GitHub_M

CVE-2026-107279CWE-303CWE-757

AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int

Published 2026-10-07 by GitHub_M

CVE-2026-107232CWE-319CWE-441CWE-522

AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT

Published 2026-10-07 by GitHub_M

Load more ↓