Use of Persistent Cookies Containing Sensitive Information

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the interceptors.cache interceptor's shared-cache mode type: 'shared', which stores responses without...

Use of Persistent Cookies Containing Sensitive Information

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the interceptors.cache interceptor's shared-cache mode type: 'shared', which stores response...

CVE-2026-84933

A flaw was found in undici. The software's caching mechanism, when operating in shared cache mode, improperly stores responses that include 'Set-Cookie' headers. This oversight allows an untrusted server to inject cookies into cached responses. Consequently, sensitive cookie information from one...

CVE-2026-80890

In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctpunpackcookie skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing...

AZL-99642 CVE-2026-80890 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctpunpackcookie skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing...

CVE-2026-53756

Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in UserModel::getUserDataByLogin. The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie...

CVE-2026-53756 Emlog Blind SQL Injection via Authentication Cookie

Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in UserModel::getUserDataByLogin. The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie...

CVE-2026-53756 Emlog Blind SQL Injection via Authentication Cookie

Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in UserModel::getUserDataByLogin. The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie...

CVE-2026-53756

Emlog CMS Pro, an open-source website building system, contains a blind SQL injection in the User_Model::getUserDataByLogin() method prior to version 2.6.16. The root cause is the $account parameter being directly interpolated into SQL queries without filtering. The vulnerability is reachable via...

EUVD-2026-71623

Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in UserModel::getUserDataByLogin. The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie...

CVE-2026-53756 Emlog Blind SQL Injection via Authentication Cookie

Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in UserModel::getUserDataByLogin. The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie...

DEBIAN-CVE-2026-84933

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

CVE-2026-84933

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

CVE-2026-84933

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

UBUNTU-CVE-2026-84933

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

EUVD-2026-71640

In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctpunpackcookie skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing...

CVE-2026-80890 sctp: reject stale cookies with mismatched verification tags

In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctpunpackcookie skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing...

CVE-2026-80890

In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctpunpackcookie skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing...

CVE-2026-80890

This Linux kernel SCTP vulnerability affects sctp_unpack_cookie(), which incorrectly skips cookie expiration checks whenever an association already exists—a broader exception than permitted by RFC 9260 Section 5.2.4 . The bug allows an expired Action A restart cookie to reach sctp_sf_do_dupcook_a...

CVE-2026-80890 sctp: reject stale cookies with mismatched verification tags

In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctpunpackcookie skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing...