CVE-2026-66746 Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...

CVE-2026-66746

Rouille 0.4.0–3.6.2 contains an HTTP response splitting vulnerability. An attacker can inject CR/LF into attacker-controlled input, causing arbitrary response headers to be added via reflected percent-decoded query parameters or bare LF in Cookie headers into Set-Cookie headers. This enables cach...

PT-2026-65517

Name of the Vulnerable Software and Affected Versions Rouille versions 0.4.0 through 3.6.2 Description An HTTP response splitting issue exists where remote attackers can inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into input they control. This can...

ALSA-2026:47177 Important: yelp security update

Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook. Security Fixes: yelp: yelp-xsl: Overly Permissive Content Security Policy i...

CVE-2026-47723

Nebula-mesh is affected by missing security headers in internal/web/ and internal/api/ paths prior to v0.3.1 (up to v0.3.0). The root cause is absence of standard headers such as CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Strict-Transport-Security in responses, enabling cl...

CVE-2026-47723 nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

CVE-2026-47723

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

EUVD-2026-48424

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

CVE-2026-47723 nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Parser component of Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policies through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Network component of Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to bypass content security policies through malicious network traffic. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Subresource Integrity in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via malicious network traffic. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Network of Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policy through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy through a crafted Chrome extension. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in isolated web apps in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Low...

MiracleLinux 9 : webkit2gtk3-2.52.4-1.el9_8 (AXSA:2026-1338:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1338:05 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2026-28946 webkitgtk: Processing maliciously crafte...

Amazon Linux 2 : yelp, --advisory ALAS2-2026-3821 (ALAS-2026-3821)

The version of yelp installed on the remote host is prior to 3.28.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3821 advisory. A flaw was found in Yelp due to an overly permissive Content Security Policy CSP implementation provided by yelp-xsl. A malicious...

CVE-2026-54163

secureheaders manages application of security headers with many safe defaults. Prior to 7.3.0, secureheaders builds the Content-Security-Policy value by stitching directives with ; separators, and buildsandboxlistdirective, buildmediatypelistdirective, and buildreporttodirective interpolate...