EUVD-2026-71518

undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches...

GHSA-2JFJ-6HJV-FM6J undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

Impact undici's interceptors.cache does not handle Set-Cookie in the cache path. In shared-cache mode type: 'shared', the default, a cacheable response for example Cache-Control: public, max-age=... carrying a Set-Cookie header is stored, and the stored Set-Cookie is re-served to a later caller...

undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

Impact undici's interceptors.cache does not handle Set-Cookie in the cache path. In shared-cache mode type: 'shared', the default, a cacheable response for example Cache-Control: public, max-age=... carrying a Set-Cookie header is stored, and the stored Set-Cookie is re-served to a later caller...

NPM: undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

NPM: undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches vulnerability discovered by ? in WordPress Npm undici versions = 7.0.0, 7.29.1...

DEBIAN-CVE-2026-101280

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarcpolicyquerydmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public...

CVE-2026-101280

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarcpolicyquerydmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public...

UBUNTU-CVE-2026-101280

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarcpolicyquerydmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public...

CLEANSTART-2026-XL00241 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header

Security vulnerability affects the langfuse package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...

EUVD-2026-88595

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarcpolicyquerydmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public...

CVE-2026-101280

A vulnerability exists in Trusted Domain Project OpenDMARC (up to version 1.4.2 ) within the Multi-Record Set Handler component. Specifically, the opendmarc_policy_query_dmarc function is susceptible to manipulation, which can lead to an authentication bypass via spoofing . This attack can be exe...

CVE-2026-101280 Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarcpolicyquerydmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public...

CVE-2026-101280 Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarcpolicyquerydmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public...

CVE-2026-101280

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarcpolicyquerydmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public...

CVE-2026-79535

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

PT-2026-102417

Name of the Vulnerable Software and Affected Versions OpenDMARC versions prior to 1.4.3 Description A remote authentication bypass via spoofing is possible in the Multi-Record Set Handler component. The issue resides in the opendmarc policy query dmarc function. Recommendations Update to a versio...

CVE-2026-79535

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

EUVD-2026-89361

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

PT-2026-102653

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A TLS server may experience an out-of-bounds read and a fixed-value out-of-bounds write on the server heap when calling the SSL set SSL CTX function to switch a connection to a different SSL...

CVE-2026-79535

The mbailey VoiceMode software (versions

PT-2026-102934

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description A flaw in the set time zone function within the '/api/ZRFirmware/set time zone' endpoint allows for remote command injection. This occurs through the manipulation of the hostname/zonename argument...