CVE-2026-4096

MediumCVSS 6.1/10Last modified Jul 27, 2026

Description

IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-644

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2026
Last modified
Jul 27, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-409608.1Luanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment. If at least one mod is listed as secure.trusted_mods oCVE-2026-409617.2A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url` check, enablinCVE-2026-409629.8FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.cCVE-2026-409633.1The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller hCVE-2026-409647.5Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read CVE-2026-4096510.0Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC CVE-2026-409665.9In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrCVE-2026-409678.6In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector storCVE-2026-409688.8When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can bCVE-2026-409695.3The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status descriptionCVE-2026-409706.8When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting CVE-2026-409719.1When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to th