CVE-2026-69183 | High | 7.5 | 2026-08-20 | Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.t… |
CVE-2026-67179 | High | 7.8 | 2026-08-11 | Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reac… |
CVE-2026-66778 | Medium | 5.3 | 2026-08-11 | SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a… |
CVE-2026-72574 | Medium | 6.1 | 2026-08-10 | A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS asset… |
CVE-2026-0516 | Medium | 6.5 | 2026-08-05 | A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirec… |
CVE-2026-48061 | Medium | 5.9 | 2026-08-03 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omit… |
CVE-2026-21762 | Low | 3.7 | 2026-07-17 | HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as… |
CVE-2026-54477 | Medium | 5.4 | 2026-07-03 | The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks. |
CVE-2026-55791 | | | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Serv… |
CVE-2024-51454 | Medium | 6.5 | 2026-06-22 | IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004 is vulnerable… |
CVE-2026-10836 | | | 2026-06-17 | Improper handling of HTTP headers that allows a remote attacker to manipulate the value of the Host header using specially crafted requests. A successful explo… |
CVE-2026-4096 | Medium | 6.5 | 2026-06-11 | IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an att… |
CVE-2026-48126 | High | 8.2 | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --dom… |
CVE-2026-33805 | High | 8.6 | 2026-04-15 | @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own he… |
CVE-2025-66485 | Medium | 5.4 | 2026-04-01 | IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an… |
CVE-2026-33149 | High | 8.1 | 2026-03-26 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and including 2.5.3 set ALLOWED_HOSTS = '*'… |
CVE-2025-14807 | Medium | 6.5 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers… |
CVE-2025-13213 | Medium | 5.4 | 2026-03-10 | IBM Aspera Orchestrator 3.0.0 through 4.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allo… |
CVE-2025-36227 | Medium | 5.4 | 2026-03-10 | IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allo… |
CVE-2025-70948 | Critical | 9.3 | 2026-03-05 | A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account tak… |
CVE-2026-1698 | Medium | 6.1 | 2026-02-26 | A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote a… |
CVE-2026-26747 | Critical | 9.1 | 2026-02-20 | A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined… |
CVE-2025-27901 | Medium | 6.5 | 2026-02-17 | IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows is vulnerable to HTTP header injection, caused by impro… |
CVE-2026-26234 | High | 8.8 | 2026-02-12 | JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override request URLs by injectin… |
CVE-2024-51451 | Medium | 6.5 | 2026-02-04 | IBM Concert 1.0.0 through 2.1.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attack… |
CVE-2025-52660 | Low | 2.7 | 2026-01-19 | HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution… |
CVE-2025-64425 | High | 8.1 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an… |
CVE-2025-67724 | Medium | 5.4 | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP header… |
CVE-2025-13803 | High | 7.3 | 2025-12-01 | A vulnerability was identified in MediaCrush 1.0.0/1.0.1. The affected element is an unknown function of the file /mediacrush/paths.py of the component Header… |
CVE-2025-13434 | Medium | 5.3 | 2025-11-20 | A weakness has been identified in jameschz Hush Framework 2.0. The impacted element is an unknown function of the file Hush\hush-lib\hush\Util.php of the compo… |
CVE-2025-36223 | Medium | 5.4 | 2025-11-12 | IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to c… |
CVE-2025-64484 | High | 8.5 | 2025-11-10 | OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load… |
CVE-2025-52647 | Medium | 6.1 | 2025-10-10 | The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks. |
CVE-2024-40686 | Medium | 5.4 | 2025-07-23 | IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 is vulnerable to HTTP header injection, caused by improper val… |
CVE-2025-40631 | Medium | 6.1 | 2025-05-16 | HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScri… |
CVE-2025-24339 | Medium | 5.0 | 2025-04-30 | A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the vulnerable system… |
CVE-2025-2950 | Medium | 5.4 | 2025-04-18 | IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. A… |
CVE-2022-43847 | Medium | 5.4 | 2025-04-14 | IBM Aspera Console 3.4.0 through 3.4.4
is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow a… |
CVE-2025-0154 | Medium | 5.3 | 2025-04-02 | IBM TXSeries for Multiplatforms 9.1 and 11.1 could disclose sensitive information to a remote attacker due to improper neutralization of HTTP headers. |
CVE-2025-27632 | Medium | 6.1 | 2025-03-25 | A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multipl… |
CVE-2023-35894 | Medium | 5.4 | 2025-03-07 | IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an… |
CVE-2025-23191 | Low | 3.1 | 2025-02-11 | Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by modifying the Host header value in an HTTP GET request. An atta… |
CVE-2025-23001 | Medium | 6.1 | 2025-01-31 | A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can ma… |
CVE-2024-30129 | Medium | 5.3 | 2024-12-06 | The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be se… |
CVE-2024-10006 | High | 8.3 | 2024-10-30 | A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based acces… |
CVE-2024-47549 | High | 7.4 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers.
Ac… |
CVE-2023-26289 | Medium | 5.4 | 2024-07-30 | IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker… |
CVE-2024-39736 | Medium | 6.5 | 2024-07-15 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers… |
CVE-2022-22399 | Medium | 5.4 | 2024-03-05 | IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an atta… |
CVE-2024-21499 | Medium | 4.3 | 2024-02-17 | All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due to redirecting to t… |
CVE-2023-45190 | Medium | 5.1 | 2024-02-09 | IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. Thi… |
CVE-2024-1064 | High | 7.5 | 2024-02-03 | A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Servi… |
CVE-2023-47143 | Critical | 10.0 | 2024-02-02 | IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by… |
CVE-2023-34036 | Medium | 5.3 | 2023-07-17 |
Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind… |
CVE-2023-36921 | High | 7.2 | 2023-07-11 | SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request. This misleads SAP Diagnostics Agent to… |
CVE-2023-32465 | High | 8.8 | 2023-06-14 |
Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability. An attacker could potentially exploit this vulnerability, leading to unaut… |
CVE-2022-45102 | Medium | 5.4 | 2023-02-01 |
Dell EMC Data Protection Central, versions 19.1 through 19.7, contains a Host Header Injection vulnerability. A remote unauthenticated attacker may potentiall… |
CVE-2021-38997 | Medium | 5.4 | 2022-12-12 | IBM API Connect V10.0.0.0 through V10.0.5.0, V10.0.1.0 through V10.0.1.7, and V2018.4.1.0 through 2018.4.1.19 is vulnerable to HTTP header injection, caused by… |
CVE-2022-34316 | Low | 3.7 | 2022-11-14 |
IBM CICS TX 11.1 does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can proce… |
CVE-2021-41114 | Medium | 4.8 | 2021-10-05 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofi… |
CVE-2021-20784 | Medium | 6.1 | 2021-07-14 | HTTP header injection vulnerability in Everything version 1.0, 1.1, and 1.2 except the Lite version may allow a remote attacker to inject an arbitrary script o… |
CVE-2021-21265 | Medium | 6.8 | 2021-03-10 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured… |
CVE-2020-6982 | High | 8.8 | 2020-03-24 | In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution. |
CVE-2017-6031 | High | 8.8 | 2017-05-06 | A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax"… |