EUVD-2026-82736

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

CVE-2026-89058

RESTEasy 's CorsFilter contains a cross-origin policy flaw: when configured with the wildcard origin "*", it reflects the request's Origin header back in the Access-Control-Allow-Origin response while also setting Access-Control-Allow-Credentials: true. This allows a malicious website to make cre...

Exploit for CVE-2026-93453

CVE-2026-93453 — SOGo Password Reset Link Poisoning via Origin...

CVE-2026-88798 Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages...

CVE-2026-88798 Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages...

DirtyAH6

DirtyAH6 CVE-2026-80844 Writeuphttps://heyitsas.im/posts...

SUSE CVE-2024-58384

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests...

SUSE CVE-2026-19773

libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw...

EUVD-2026-82605

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

SUSE CVE-2026-85732

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...

DEBIAN-CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

UBUNTU-CVE-2026-93453

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

CVE-2026-93453: Weak Password Recovery Mechanism for Forgotten Password

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

CVE-2026-61682: Authentication Bypass by Spoofing

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...

CVE-2026-81179: Reliance on Untrusted Inputs in a Security Decision

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWEDHOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : libsoup vulnerabilities (USN-8780-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8780-1 advisory. It was discovered that libsoup incorrectly...

Oracle Linux 8 : libevent (ELSA-2026-67908)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-67908 advisory. - Fix CVE-2026-63385: HTTP header injection via CRLF in header values - Fix CVE-2026-63387: out-of-bounds write in evdns dnsnametolabels - Fix...

EulerOS Virtualization 2.12.0 : python-pip (EulerOS-SA-2026-3666)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to t...