GHSA-WWV5-G3V4-889X Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

Summary The CVE-2026-35536 fix added a validation loop that rejects \x00-\x20\x3b\x7f, but only for the hardcoded lowercase keys name/domain/path/samesite. The still-live deprecated kwargs path writes attacker-supplied attribute values straight into the Morsel with no validation, and because...

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

Summary The CVE-2026-35536 fix added a validation loop that rejects \x00-\x20\x3b\x7f, but only for the hardcoded lowercase keys name/domain/path/samesite. The still-live deprecated kwargs path writes attacker-supplied attribute values straight into the Morsel with no validation, and because...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the setcookie method when...

Security update for apache2-mod_auth_openidc

This update for apache2-modauthopenidc fixes the following issue: CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of modauthopenidc bsc1276217. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:3915-1 Security update for apache2-mod_auth_openidc

This update for apache2-modauthopenidc fixes the following issue: - CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of modauthopenidc bsc1276217...

[SECURITY] [DLA 4734-1] lemonldap-ng security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4734-1 [email protected] https://www.debian.org/lts/security/ Xavier Guimard August 12, 2026 https://wiki.debian.org/LTS -...

OPENSUSE-SU-2026:21717-1 Security update for apache2-mod_auth_openidc

This update for apache2-modauthopenidc fixes the following issue: - CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of modauthopenidc bsc1276217...

SUSE-SU-2026:23593-1 Security update for apache2-mod_auth_openidc

This update for apache2-modauthopenidc fixes the following issue: - CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of modauthopenidc bsc1276217...

CVE-2026-18752 Persistent Login <= 3.1.0 - Authenticated (Subscriber+) SQL Injection via 'wppl_device_id' Cookie

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppldeviceid' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-18752 Persistent Login <= 3.1.0 - Authenticated (Subscriber+) SQL Injection via 'wppl_device_id' Cookie

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppldeviceid' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

EUVD-2026-68971

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppldeviceid' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-75865

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...

CVE-2026-75865 WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...

CVE-2026-75865

WPLP Cookie Consent (a WordPress plugin for GDPR/CCPA consent management) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 4.4.1 . The root cause combines missing file type validation in the saas_upload_logo() function with an authorization bypass on the ...

CVE-2026-75865 WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...

EUVD-2026-68931

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...

PT-2026-92105

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.8 Description An incomplete fix for cookie attribute injection allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to the set cookie function. The validation...

CVE-2026-75865: Unrestricted Upload of File with Dangerous Type

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...

PT-2026-84075

Name of the Vulnerable Software and Affected Versions WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode versions prior to 4.4.2 Description An arbitrary file upload issue exists due to missing file type validation in the saas upload logo function combin...

glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...