CVE-2026-63416 draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo to build a proxyPath and appends it directly to EXPORTURL without rejecting dot segments or confirming that the normalize...

CVE-2026-36470

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php...

CVE-2026-62987 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

CVE-2026-62987

Fabio (an HTTP/S and TCP router for Consul-managed applications) versions 1.6.6 through 1.7.2 contain an incomplete fix for CVE-2025-48865 . The protectHeaders logic in proxy/http_headers.go covers a hardcoded set of forwarded headers but omits operator-configured ClientIPHeader , TLSHeader , and...

CVE-2026-62987 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

CVE-2026-62987 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

PYSEC-2026-3990

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

PYSEC-2026-3989

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

PYSEC-2026-3990

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...

Reliance on Untrusted Inputs in a Security Decision

Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the Nexus callback routing logic in chasm/lib/callback/request.go and components/callbacks/request.go. An attacker can make the History service send a state-changing internal...

CVE-2026-86473 Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

CVE-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-94216

A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Handler. Executing a manipulation of the argument Success can lead to http response splitting. It is...

CVE-2026-94216 ST Engineering iDirect Evolution/Velocity WebServer Evolution HTTP Request authorize response splitting

A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Handler. Executing a manipulation of the argument Success can lead to http response splitting. It is...

CVE-2026-94216

An open redirect vulnerability affects ST Engineering iDirect Evolution and Velocity WebServer Evolution (up to build 20260717). The flaw resides in the authorize function of the file /usr/sbin/webserver, specifically in the HTTP Header Handler component. Manipulating the Success argument allows ...

CVE-2026-94216 ST Engineering iDirect Evolution/Velocity WebServer Evolution HTTP Request authorize response splitting

A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Handler. Executing a manipulation of the argument Success can lead to http response splitting. It is...

EUVD-2026-83907

A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This vulnerability affects the function authorize of the file /usr/sbin/webserver of the component HTTP Header Handler. Executing a manipulation of the argument Success can lead to...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...