CVE-2026-86863 pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.getuser read config.WEBSERVERREMOTEUSER from request.environ and, when that returned...

tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated

Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid...

tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.

A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials...

CVE-2026-85077

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place...

CVE-2026-82209

A flaw was found in libcurl when libpsl support is enabled. A remote attacker could exploit this vulnerability by setting a Set-Cookie header with a Domain attribute that explicitly matches a public suffix. This improper handling causes libcurl to save the cookie with a wildcard domain scope,...

tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated

Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid...

tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.

A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials...

tomcat: Client certificate verification bypass due to virtual host mapping

A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one ...

tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.

A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials...

tomcat: Client certificate verification bypass due to virtual host mapping

A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one ...

tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.

A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials...

tomcat: Client certificate verification bypass due to virtual host mapping

A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one ...

CVE-2026-85077

A flaw was found in Sanic. The HTTP/1.1 response pipeline does not properly validate carriage-return or line-feed characters in response header names and values. This allows applications that place attacker-controlled data in response headers, filenames, or cookie attributes to inject additional...

tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.

A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials...

tomcat: Client certificate verification bypass due to virtual host mapping

A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one ...

EUVD-2026-80991

oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass...

oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

Summary A flaw in the CORS plugin allowed the incoming request's Vary header to be reflected into the response, letting a client influence a header that should be controlled solely by the server. Details The CORS plugin previously copied the request's Vary header directly onto the response instea...

GHSA-J9V4-RHGR-4M5F oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

Summary A flaw in the CORS plugin allowed the incoming request's Vary header to be reflected into the response, letting a client influence a header that should be controlled solely by the server. Details The CORS plugin previously copied the request's Vary header directly onto the response instea...

GHSA-9G45-5XWM-F3WC RMCP: Custom HTTP headers leak to cross-origin redirect targets

Summary The rmcp crate's StreamableHttpClientTransport forwards caller-supplied custom HTTP headers such as X-API-Key, X-Auth-Token, Api-Key to cross-origin redirect targets. The defaulthttpclient function builds a reqwest::Client without a redirect policy override, so the default limited10 polic...

RMCP: Custom HTTP headers leak to cross-origin redirect targets

Summary The rmcp crate's StreamableHttpClientTransport forwards caller-supplied custom HTTP headers such as X-API-Key, X-Auth-Token, Api-Key to cross-origin redirect targets. The defaulthttpclient function builds a reqwest::Client without a redirect policy override, so the default limited10 polic...