FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
CVE-2026-67289
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controll
#cwe-113
共收录 53 条相关情报。
← 返回所有主题tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into HTTP header value...
CVE-2026-66753
tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0...
CVE-2026-66746
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arb
Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
CVE-2026-66746
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arb
tiny-http 0.12.0 HTTP Response Splitting via Header Injection
CVE-2026-66753
tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return
swift-nio-http2: Missing CR/LF/NUL validation in header values
CVE-2026-64785
## Summary SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forw...
CVE-2026-63771
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by
Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header
CVE-2026-63771
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by
secure_headers manages application of security headers with many safe defaults. Prior to 7.3.0, secure_headers builds the Content-Security-Policy value by stitching directives w...
CVE-2026-54163
secure_headers 是一个用于管理安全响应头的 Ruby 库，提供了许多安全的默认设置。在版本 7.3.0 之前，该库在构建 Content-Security-Policy (CSP) 头时存在注入漏洞。具体来说，`secure_
Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input
CVE-2026-54163
## Summary `secure_headers` builds the `Content-Security-Policy` value by stitching every configured directive together
Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`
CVE-2026-48596
### Summary `Tesla.Multipart.add_content_type_param/2` appends caller-supplied strings to the multipart `Content-Type`
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Http Remote class, including Remote::request(), Remote::get(...
CVE-2026-50188
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Htt
Kirby: Request header injection in `Http\Remote`
CVE-2026-50188
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Htt
Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. ...
CVE-2025-71381
Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to...
CVE-2026-50269
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled inp
A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated witho...
CVE-2026-50630
A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate res
Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructe...
CVE-2026-44489
Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created b
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did not reject ASCII control characters, whitespace, or DEL in first-party URI ho...
CVE-2026-49214
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did not reject ASCII con
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR byte...
CVE-2026-43966
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipar...
CVE-2026-48596
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-te