31645 matches found
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
SummaryThe CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless of...
PYSEC-2026-3824 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...
coderedcms (>=2.0.0, <=2.1.4), puput (1.2.0) +27 more potentially affected by CVE-2026-55468 via wagtail (4.2.4)
wagtail PYPI version 4.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms =2.0.0, =0.1.0, =0.3.4, =0.0.1, =1.6.0, =0.18.0, =0.19.2 - wagtail-hallo 0.3.0 - wagtail-images-deduplicator 1.0.0a1 and more Source...
PYSEC-2026-3816 Cognee allows non-superusers to overwrite global LLM configuration
Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...
CVE-2026-15889 Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...
EUVD-2026-75366
The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...
CVE-2026-15889
The Aruba HiSpeed Cache WordPress plugin is affected by a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 3.0.14 , caused by insufficient input sanitization and output escaping in the Post Content field. An authenticated attacker with Contributor-level access o...
CVE-2026-15889 Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...
USN-8742-1 netty vulnerability
It was discovered that Netty incorrectly validates the bailiwick of NS records. An attacker could possibly use this issue to facilitate DNS cache poisoning attacks...
USN-8742-1: Netty vulnerability
It was discovered that Netty incorrectly validates the bailiwick of NS records. An attacker could possibly use this issue to facilitate DNS cache poisoning attacks...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.70 bug fix and security update
Red Hat OpenShift Container Platform release 4.16.70 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...
CLEANSTART-2026-ED42524 Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded...
Multiple security vulnerabilities affect the spring-boot package. Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth. See references for...
CLEANSTART-2026-ZI93173 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
Multiple security vulnerabilities affect the kubernetes-dns-node-cache package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...
CLEANSTART-2026-GK68352 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
Multiple security vulnerabilities affect the kubernetes-dns-node-cache package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...
kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
A flaw was found in the Linux kernel's handling of RAW sockets using IPPROTORAW. A remote attacker could send a specially crafted ICMP Internet Control Message Protocol packet. This malicious packet could set the protocol field to 255, causing it to be processed by a RAW socket configured for...
PT-2026-89485
TrendAI Apex One Security Agent Cache Mechanism Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability...
Security update for libzypp, zypper (critical)
openSUSE security update: security update for libzypp, zypper ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21808-1 Rating: critical References: bsc1257249 bsc1271730 bsc1272534 bsc1273242 bsc1274091 bsc1274625 bsc1277790 Affected Products: openSU...
PT-2026-89731
It was discovered that Netty incorrectly validates the bailiwick of NS records. An attacker could possibly use this issue to facilitate DNS cache poisoning attacks...
PT-2026-89337
The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...
TrendAI Apex One Security Agent Cache Mechanism Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of TrendAI Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...