CVE-2026-74800 SiYuan before v3.7.4 Stored XSS via assets endpoint

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace own...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100877)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100877 advisory. When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a or tag, potentially making a...

CVE-2026-16098 ProSolution WP Client <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSolhandleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the...

CVE-2026-16098

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSolhandleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the...

EUVD-2026-59855

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSolhandleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the...

CVE-2026-16098 ProSolution WP Client <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSolhandleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the...

CVE-2026-16098

CVE-2026-16098 affects the ProSolution WP Client plugin for WordPress up to version 2.0.10, where the proSol_handleFileUpload function allows Arbitrary File Upload. The root cause is missing validation of the attacker-controlled Content-Disposition header filename, which can override the allowed ...

PT-2026-73095

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol handleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the...

PT-2026-72881

Name of the Vulnerable Software and Affected Versions Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! versions prior to 3.7.2 Description Authenticated attackers with contributor-level access and above can achieve remote code execution via the fetc...

CVE-2026-73531

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...

CVE-2026-73531 django-helpdesk < 2.3.3 Stored XSS via HTML Attachments

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...

CVE-2026-73531 django-helpdesk < 2.3.3 Stored XSS via HTML Attachments

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...

Security Bulletin: form-data CRLF Injection via Unescaped Field Name and Filename

Summary form-data versions through 4.0.5 are vulnerable to CRLF injection CWE-93, CVSS 7.5, High. Field names and filenames passed to FormDataappend are not sanitized before being written into the Content-Disposition header, allowing an attacker who controls those values to inject arbitrary heade...

RCE (Remote Code Execution) form-data Dependency in Jira Software Data Center

This High severity RCE Remote Code Execution vulnerability was introduced in versions 9.17.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.7 and...

io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

A flaw was found in Netty's HttpPostRequestEncoder, a widely used Java networking library component responsible for constructing multipart HTTP request bodies. The issue arises because user-supplied filenames and field names are directly embedded into Content-Disposition MIME headers without any...

io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

A flaw was found in Netty's HttpPostRequestEncoder, a widely used Java networking library component responsible for constructing multipart HTTP request bodies. The issue arises because user-supplied filenames and field names are directly embedded into Content-Disposition MIME headers without any...

Linux Distros Unpatched Vulnerability : CVE-2026-59921

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs...

CVE-2026-59921 Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without...

CVE-2026-59921 Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without...

CVE-2026-66729 facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser

facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32t wraparound ...