Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 07:05 UTC

Critical in the last 24 hours

1602 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

164-72% vs 7-day avg of 596

3 critical, 57 high, 70 medium, 29 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	7.5	CVE-2026-97032	HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently Go standard library, golang.org/x/netGo standard library net/http, Go standard library net/http/internal/http2, golang.org/x/net/http2	NVD	Oct 8 23:17 UTC
CVE-2026-97032HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently From the advisory HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Go standard library golang.org/x/net Go standard library net/http Go standard library net/http/internal/http2 golang.org/x/net/http2 NIST National Vulnerability DatabasePublished Oct 8, 2026 23:17 UTC Read the advisory
	High	7.5	CVE-2026-78669	A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing... Go standard library, golang.org/x/netGo standard library net/http, Go standard library net/http/internal/http2, golang.org/x/net/http2	NVD	Oct 8 23:17 UTC
CVE-2026-78669A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing... From the advisory A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Go standard library golang.org/x/net Go standard library net/http Go standard library net/http/internal/http2 golang.org/x/net/http2 NIST National Vulnerability DatabasePublished Oct 8, 2026 23:17 UTC Read the advisory
	Critical	9.1	CVE-2026-78663	The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the... Go standard library, golang.org/x/netGo standard library net/http, Go standard library net/http/internal/http2, golang.org/x/net/http2	NVD	Oct 8 23:17 UTC
CVE-2026-78663The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the... From the advisory The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Affects Go standard library golang.org/x/net Go standard library net/http Go standard library net/http/internal/http2 golang.org/x/net/http2 NIST National Vulnerability DatabasePublished Oct 8, 2026 23:17 UTC Read the advisory
	High	7.5	CVE-2026-78660	Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing Go standard library, golang.org/x/netGo standard library net/http, Go standard library net/http/internal/http2, golang.org/x/net/http2	NVD	Oct 8 23:17 UTC
CVE-2026-78660Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing From the advisory Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affects Go standard library golang.org/x/net Go standard library net/http Go standard library net/http/internal/http2 golang.org/x/net/http2 NIST National Vulnerability DatabasePublished Oct 8, 2026 23:17 UTC Read the advisory
	High	7.5	CVE-2026-78659	When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler Go standard library, golang.org/x/netGo standard library net/http, Go standard library net/http/internal/http2, golang.org/x/net/http2	NVD	Oct 8 23:17 UTC
CVE-2026-78659When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler From the advisory When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Go standard library golang.org/x/net Go standard library net/http Go standard library net/http/internal/http2 golang.org/x/net/http2 NIST National Vulnerability DatabasePublished Oct 8, 2026 23:17 UTC Read the advisory
	Critical	n/a	RHSA-2026:89744	grafana security update Red Hat, Grafana, golang.org/x/netRed Hat Enterprise Linux, golang.org/x/net/http2, Grafana	Red Hat Security Advisories	Oct 26 03:03 UTC
RHSA-2026:89744grafana security update Executive summary Red Hat's advisory RHSA-2026:89744 covers the grafana package for Red Hat Enterprise Linux 9 and fixes five security vulnerabilities, including an information disclosure flaw in Grafana Unified Alerting and several Go standard library flaws. Red Hat rated the update as having a Critical security impact. Red Hat recommends applying the updated grafana packages, and the advisory points to its standard update instructions for how to do so. Technical summary The advisory lists five CVEs: CVE-2026-17183 (information disclosure in Grafana Unified Alerting), CVE-2026-78667 and CVE-2026-78669 (denial of service via crafted HTTP Range headers and excessive HTTP/2 SETTINGS frames in net/http), CVE-2026-97031 (denial of service via multiple ECH outer extension references in crypto/tls), and CVE-2026-111943 (man-in-the-middle attacks via untrusted intermediate certificates in crypto/x509). The fixed version is grafana-10.2.6-23.el9_8.7 for the affected RHEL 9 streams. The advisory does not state the attack vector or preconditions for each flaw, does not give a CVSS score in the text (it refers to CVE pages), and does not state any workaround. No detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Go net/http Dropped extracted product not named in the source: Go crypto/tls Dropped extracted product not named in the source: Go crypto/x509 Summarized from access.redhat.com/errata/RHSA-2026:89744 Score No CVSS score published. Affects Red Hat Grafana golang.org/x/net Red Hat Enterprise Linux golang.org/x/net/http2 Grafana Red Hat Product SecurityPublished Oct 26, 2026 03:03 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Score

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee