CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Starlette Security Middleware Bypass via Insufficient HTTP Host Header Validation (CVE-2026-48710)
[Affected Scope] All web applications utilizing Starlette ASGI framework prior to version 1.0.1
[Impact] Malformed Host headers can cause a discrepancy between the actual routed path and request.url.path, allowing attackers to bypass URL-based security middleware and access controls
[Mitigation] Immediately upgrade the Starlette package to version 1.0.1 or higher
Oracle E-Business Suite Configurator (Runtime UI) Pre-Auth Information Disclosure & SSRF Vulnerability (CVE-2025-61884)
[Affected Scope] Oracle E-Business Suite versions 12.2.3 through 12.2.14, specifically the Oracle Configurator (Runtime UI) component.
[Impact] Unauthenticated remote attackers can exploit this vulnerability via HTTP to gain unauthorized access to critical data or compromise the entire Oracle Configurator data.
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately and restrict external HTTP/HTTPS access to the affected endpoints.
Qlik Sense Enterprise for Windows HTTP Request Tunneling Remote Code Execution Vulnerability (CVE-2023-48365)
[Affected Scope] Qlik Sense Enterprise for Windows (prior to specified patch levels)
[Impact] Unauthenticated remote attackers can elevate privileges and execute arbitrary code on the backend repository server via HTTP request tunneling.
[Mitigation] Immediately apply the official security patches (August 2023 Patch 2 or later, etc.) provided by the vendor.
Qlik Sense Enterprise for Windows HTTP Request Tunneling & Privilege Escalation Vulnerability (CVE-2023-41265) Security Advisory
[Affected Scope] Qlik Sense Enterprise for Windows (May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier)
[Impact] A remote attacker can elevate privileges and execute unauthorized commands on the backend repository application by tunneling malicious HTTP requests.
[Mitigation] Immediately upgrade to the patched versions: August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, or August 2022 Patch 13.
SAP NetWeaver and Web Dispatcher HTTP Request Smuggling Vulnerability (CVE-2022-22536) Security Advisory
[Affected Scope] SAP NetWeaver AS ABAP, AS Java, ABAP Platform, SAP Content Server 7.53, and SAP Web Dispatcher
[Impact] Unauthenticated attackers can prepend arbitrary data to a victim's request, enabling session hijacking, cache poisoning, and complete compromise of system Confidentiality, Integrity, and Availability
[Mitigation] Immediately apply the official SAP security patches (SAP Note 3123396) and restrict anomalous HTTP request headers at the reverse proxy or WAF level