WordPress W3 Total Cache plugin <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header vulnerability

Unauthenticated Security Token Exposure via User-Agent Header vulnerability discovered by wesley wcraft in WordPress Plugin W3 Total Cache versions = 2.9.3...

CVE-2026-3777

The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifies the zoom property and then triggers a page change, the original view object may be destroyed while stale pointers...

EUVD-2025-209182

IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

FreeRDP Heap Buffer Overflow Vulnerability (CNVD-2026-16033)

FreeRDP is an open source Remote Desktop Protocol RDP implementation library and client . FreeRDP suffers from a heap buffer overflow vulnerability. The vulnerability arises due to an out-of-bounds heap memory write due to a bmpSize synchronization error in the persistent cache. An attacker can...

WordPress plugin W3 Total Cache 信息泄露漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

FreeRDP Out-of-Bounds Read Vulnerability (CNVD-2026-16034)

FreeRDP is an open source Remote Desktop Protocol RDP implementation library and client . FreeRDP suffers from an out-of-bounds read vulnerability. The vulnerability arises due to a mismatch in the persistent cache allocator, which results in an out-of-bounds read of heap memory when processing...

PT-2026-29937

act: actions/cache server allows malicious cache injection in github.com/nektos/act...

ewe 注入漏洞

ewe is a lightweight web server build package developed by Vladislav Shakitskiy. Versions of ewe prior to 3.0.6 contained an injection vulnerability. This vulnerability stemmed from the encodeheaders function not verifying or stripping CRLF sequences, which could lead to response splitting, cache...

CVE-2025-66485

IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

CVE-2025-66485 Multiple vulnerabilities have been addressed in IBM Aspera Shares

IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

CVE-2025-66485

IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

CVE-2025-66485

CVE-2025-66485 is an HTTP header injection vulnerability in IBM Aspera Shares (versions 1.9.9–1.11.0). The Root Cause is improper validation of HOST header input, enabling attackers to craft requests that may lead to cross-site scripting, cache poisoning, or session hijacking. IBM has addressed t...

CVE-2025-66485 Multiple vulnerabilities have been addressed in IBM Aspera Shares

IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking...

CVE-2026-34525

A flaw was found in aiohttp, an asynchronous HTTP client/server framework for Python. This vulnerability allows a remote attacker to send multiple Host headers in a single request. This can lead to unexpected behavior, potentially bypassing security controls or causing cache poisoning, which may...

GHSA-HCC4-C3V8-RX92 AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

Summary An unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. Impact If an application makes requests to a very large number of hosts, this could cause the DNS cache to continue growing and slowly use excessive amounts of memory. ----- Patch:...

AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

Summary An unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. Impact If an application makes requests to a very large number of hosts, this could cause the DNS cache to continue growing and slowly use excessive amounts of memory. ----- Patch:...

EUVD-2026-18035

AIOHTTP Affected by Denial of Service DoS via Unbounded DNS Cache in TCPConnector...

DEBIAN-CVE-2026-34513

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4...

CVE-2026-34513

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4...

CVE-2026-34513

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4...