agentprime: CWE-644

CVE-2026-110723: Authentication bypass by spoofing in Eclipse Foundation Eclipse Connected Services Platform

Thu, 15 Oct 2026 12:14:08 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-69183: Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Thu, 20 Aug 2026 16:16:43 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-67179: Genkit improper host header validation

Tue, 11 Aug 2026 15:56:09 GMT

CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-66778: Multiple vulnerabilities in SAP Business AI Platform (Approuter)

Tue, 11 Aug 2026 00:19:50 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-72574: picocms Pico - Host Header Injection Enables Script Source Hijacking

Mon, 10 Aug 2026 10:40:57 GMT

CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-0516: SonicWall SonicOS: A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS…

Wed, 05 Aug 2026 11:50:03 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Tornado vulnerable to Header Injection and XSS via reason argument

Mon, 20 Jul 2026 18:55:11 GMT

tornado <6.5.3, fixed in 6.5.3. CVSS 5.4 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-21762: Missing HTTP Security Headers in DevOps Loop

Fri, 17 Jul 2026 17:10:33 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-54477: Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax

Thu, 02 Jul 2026 23:52:49 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir

Tue, 23 Jun 2026 21:49:11 GMT

github.com/xyproto/algernon <1.17.8, fixed in 1.17.8. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-51454: IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities Host Header Injection observed

Mon, 22 Jun 2026 14:33:55 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Fri, 19 Jun 2026 21:15:19 GMT

craftcms/cms >=4.0.0-RC1, <4.18 || >=5.0.0-RC1, <5.10, fixed in 4.18, 5.10. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-10836: Improper neutralization of HTTP headers in Password Manager

Wed, 17 Jun 2026 11:10:49 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-4096: A vulnerability has been identified in IBM DevOps Plan that allows a Host Header Injection attack due to improper handling of the Host header in HTTP requests.

Thu, 11 Jun 2026 14:44:47 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

Wed, 10 Jun 2026 19:12:10 GMT

litestar <2.22.0, fixed in 2.22.0. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Fastify's connection header abuse enables stripping of proxy-added headers

Thu, 16 Apr 2026 01:02:59 GMT

@fastify/http-proxy <11.4.4, fixed in 11.4.4. CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-66485: Multiple vulnerabilities have been addressed in IBM Aspera Shares

Wed, 01 Apr 2026 23:01:47 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-33149: Tandoor Recipes Vulnerable to Host Header Injection

Thu, 26 Mar 2026 18:53:22 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-14807: IBM InfoSphere Information Server is vulnerable to HTTP header injection

Wed, 25 Mar 2026 20:46:59 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-13213: Multiple vulnerabilities in IBM Aspera Orchestrator

Tue, 10 Mar 2026 20:15:10 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-36227: Multiple vulnerabilities in IBM Aspera Faspex

Tue, 10 Mar 2026 19:57:16 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

@perfood/couch-auth has a host header injection vulnerability

Thu, 05 Mar 2026 21:30:49 GMT

@perfood/couch-auth <=0.26.0, no fixed version yet. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-1698: HTTP Host header vulnerability in WebClient and WebScheduler web apps

Thu, 26 Feb 2026 07:58:00 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-26747: A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where…

Fri, 20 Feb 2026 00:00:00 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-27901: Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows

Tue, 17 Feb 2026 19:35:41 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-26234: JUNG Smart Visu Server - Improper Neutralization of HTTP Headers for Scripting Syntax

Thu, 12 Feb 2026 02:31:11 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-51451: Multiple Vulnerabilities in IBM Concert Software

Wed, 04 Feb 2026 21:21:44 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-52660: HCL AION is affected by an Host Header Injection vulnerability

Mon, 19 Jan 2026 17:49:52 GMT

CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-64425: Coolify has host header injection in forgot password

Mon, 05 Jan 2026 20:49:10 GMT

CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-13803: MediaCrush Header paths.py http headers for scripting syntax

Mon, 01 Dec 2025 02:32:05 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-13434: jameschz Hush Framework HTTP Host Header Util.php http headers for scripting syntax

Thu, 20 Nov 2025 01:02:05 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Backdrop CMS Host Header Injection vulnerability

Tue, 18 Nov 2025 18:32:55 GMT

backdrop/backdrop <=1.32.0, no fixed version yet. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation in github.com/oauth2-proxy/oauth2-proxy

Mon, 17 Nov 2025 19:11:23 GMT

github.com/oauth2-proxy/oauth2-proxy *, no fixed version yet. CVSS 8.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-36223: IBM OpenPages Host Header Injection

Wed, 12 Nov 2025 21:04:45 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-52647: HCL BigFix WebUI is affected by a host header poisoning vulnerability

Fri, 10 Oct 2025 22:14:50 GMT

CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-40686: IBM SmartCloud Analytics - Log Analysis HOST header injection

Wed, 23 Jul 2025 11:12:23 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-40631: HTTP host header injection vulnerability in IceWarp Mail Server

Fri, 16 May 2025 11:09:17 GMT

CVSS 2.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-24339: A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the vulnerable system, including web cache poisoning or Man-in-…

Wed, 30 Apr 2025 10:54:56 GMT

CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-2950: IBM i improper HTTP header neutralization

Fri, 18 Apr 2025 14:50:21 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2022-43847: IBM Aspera Console HTTP header injection

Mon, 14 Apr 2025 20:22:01 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-0154: IBM TXSeries for Multiplatforms information disclosure

Wed, 02 Apr 2025 15:15:46 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-27632: Hitachi Energy TRMTracker: A Host Header Injection vulnerability in TRMTracker application may allow an attacker by…

Tue, 25 Mar 2025 12:37:30 GMT

CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-35894: IBM Control Center HOST header injection

Fri, 07 Mar 2025 16:47:52 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-23191: Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP

Tue, 11 Feb 2025 00:35:15 GMT

CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-23001: A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header.

Fri, 31 Jan 2025 00:00:00 GMT

CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-30129: HCL Nomad server on Domino is affected by a host header injection vulnerability

Fri, 06 Dec 2024 15:57:41 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability

Thu, 31 Oct 2024 00:30:36 GMT

github.com/hashicorp/consul >=1.9.0, <1.20.1, fixed in 1.20.1. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-47549: Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers.

Fri, 25 Oct 2024 06:18:42 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-26289: IBM Aspera Orchestrator HTTP header injection

Tue, 30 Jul 2024 16:50:29 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-39736: IBM Datacap Navigator HTTP HOST header injection

Mon, 15 Jul 2024 01:28:53 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.