CVE-2026-84380

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...

CVE-2026-84382 HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iterbytes or aiterbytes yields bounded pieces to the application. A 64 KiB compressed chunk can expa...

CVE-2026-84380 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...

CVE-2026-84380 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...

CVE-2026-84380 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...

CVE-2026-84380

HTTPX2 , a next-generation HTTP client for Python, contains a request-smuggling vulnerability prior to version 2.11.0 . The flaw resides in Request._prepare() in _models.py, where its setdefault() logic checks Content-Length and Transfer-Encoding headers independently instead of treating them as ...

CVE-2026-84379 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

CVE-2026-53600

A flaw was found in async-tar, a library for reading and writing tar archives in Rust. The library incorrectly applies a buffered PAX size extension to an intermediary extension header instead of the intended next file entry. This allows an attacker to craft a malicious tar archive that manipulat...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

DRUPAL-CONTRIB-2026-132

This module creates permissions per node content type to control access to unpublished content. The module has allowed view access for published content, overriding other access mechanisms that might have been in place...

DRUPAL-CONTRIB-2026-118

This module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn’t sufficiently check block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block conten...

CVE-2026-78153

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...

CVE-2025-8945

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

CVE-2025-15489

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...

Sulu: Stored XSS via media download inline-disposition override

Impact Stored Cross Site Scripting XSS in the media download endpoint. The download route /media/id/download/slug and its admin variant accepts the query parameter ?inline=1. When it is present, the response is sent with the header Content-Disposition: inline for any MIME type, which overrides th...

GHSA-PP4X-CCXQ-6R33 Sulu: Stored XSS via media download inline-disposition override

Impact Stored Cross Site Scripting XSS in the media download endpoint. The download route /media/id/download/slug and its admin variant accepts the query parameter ?inline=1. When it is present, the response is sent with the header Content-Disposition: inline for any MIME type, which overrides th...

GHSA-65CV-W493-7VHQ Sulu: Fix authorization bypass when creating preview links

Impact A missing authorization check on the preview link endpoint lets a backend user create a public, unauthenticated preview URL for content they are not allowed to see. PreviewLinkController and the underlying PreviewLinkManager::generate / revoke never enforced a permission on the target...

EUVD-2025-210833

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

CVE-2025-8945 Wp Edit Password Protected < 1.3.5 - Protection Bypass via REST API

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

CVE-2025-8945 Wp Edit Password Protected < 1.3.5 - Protection Bypass via REST API

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...