EUVD-2026-77535

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

CVE-2026-90790 a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

CVE-2026-12985 Mattermost DCR redirect URI allowlist bypass via improper URL component validation

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...

CVE-2026-12985

Mattermost versions 11.9.0 and earlier , 11.8.4 and earlier , and 11.7.7 and earlier contain a flaw in Dynamic Client Registration (DCR) redirect URI validation . The application matches configured glob patterns against the raw URI string rather than individual URL components, allowing a remote u...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

EUVD-2026-77477

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache Syncope. When the Syncope SRA is configured for CAS authentication, the target Apereo CAS instance's URL is calculated by unconditionally looking at client-supplied forwarded HTTP headers. This issue affects Apache Syncope:...

CVE-2026-73191 Apache Syncope: CAS service URL injection via Forwarded HTTP headers

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache Syncope. When the Syncope SRA is configured for CAS authentication, the target Apereo CAS instance's URL is calculated by unconditionally looking at client-supplied forwarded HTTP headers. This issue affects Apache Syncope:...

CVE-2026-73191 Apache Syncope: CAS service URL injection via Forwarded HTTP headers

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache Syncope. When the Syncope SRA is configured for CAS authentication, the target Apereo CAS instance's URL is calculated by unconditionally looking at client-supplied forwarded HTTP headers. This issue affects Apache Syncope:...

CVE-2026-73191

Apache Syncope is vulnerable to an Open Redirect vulnerability when the Syncope SRA is configured for CAS authentication . The root cause is that the target Apereo CAS instance's URL is calculated by unconditionally relying on client-supplied forwarded HTTP headers. This issue affects versions 3....

CVE-2026-90937 froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files duri...

Astra Linux – Vulnerability in Python-Django

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are vulnerable to a ReDoS regular expression denial of service attack due to a very large number of domain name labels for emails and URLs...

Astra Linux – Vulnerability in Firefox

The sourceMapURL feature in devtools lacked security checks, which would have prevented a webpage from attempting to include local files or other files that should be inaccessible. This vulnerability affects Firefox versions earlier than 99...

Astra Linux – Vulnerability in Apache2

A encoding issue in the modproxy component of the Apache HTTP Server 2.4.59 and earlier versions allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication through crafted requests. Users are recommended to upgrade to version 2.4.60, which fix...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

Astra Linux – Vulnerability in Firefox and Thunderbird

Through a series of API calls and redirections, an alert dialog controlled by an attacker could have been displayed on another website with the victim website’s URL shown. This vulnerability affects Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8...

Astra Linux – Vulnerability in Golang 1.15, Golang 1.19

Actions that insert URLs into the content attribute of HTML meta tags do not escape those URLs. This can lead to XSS attacks if the meta tag also contains an http-equiv attribute with the value “refresh”. A new GODEBUG setting, htmlmetacontenturlescape, has been added, which can be used to disabl...

Astra Linux – Vulnerability in Wireshark

Improper URL handling in Wireshark versions 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 may allow for remote code execution through packet injection or crafted capture files...

Astra Linux – Vulnerability in Rails

A potential information disclosure/vulnerability in Action Pack = 2.0.0, where using the redirectto or polymorphicurl helper with untrusted user input may lead to unintended method executions...

Astra Linux – Vulnerability in Chromium

The incorrect security interface in the Loader component in Google Chrome prior to version 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox URL bar through a crafted HTML page...

Astra Linux – Vulnerability in Firefox and Thunderbird

When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...