EUVD-2026-66335

The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbwgethashkey function that uses the current user's identity instead of the cookie username...

CVE-2026-75977

Mang Board WP WordPress plugin (all versions ≤ 2.3.7 ) suffers from a Missing Authorization vulnerability via authentication cookie forgery. The root cause is flawed HMAC generation in mbw_get_hash_key(), which uses the current user's identity instead of the cookie's username parameter when a Wor...

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...

CVE-2025-56798

Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy...

PT-2026-82331

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.15.3 Description Stored cross-site scripting occurs when file comments are stored as raw text and rendered into the page using innerHTML without sanitization. The backend only performs a length check, allowing a team...

EUVD-2025-210782

Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy...

PT-2026-82132

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCTP implementation where the COOKIE ECHO process restores fixed-size AUTH fields directly from peer-controlled cookie bytes when cookie authentication is disabled...

NSD -- multiple vulnerabilities

NLnet Labs reports: CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Reported by Qifan Zhang from Palo Alto Networks, Claude and Ada Logics. CVE-2026-18916: Any remote client can denial TCP service by throttling the TCP receive window down to 1. Reported b...

Linux Distros Unpatched Vulnerability : CVE-2026-48548

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormI...

CVE-2025-56798

CVE-2025-56798 is a Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology's Unraid OS version 6.12.14 and earlier . The root cause is the Unraid authentication cookie's lax same-site policy , which allows remote attackers to escalate privileges after required user interaction. The CV...

PT-2026-82208

Name of the Vulnerable Software and Affected Versions Nagios Core versions prior to 4.5.13 Nagios XI versions prior to 2026R1.5 Description A Cross-Site Request Forgery CSRF issue exists in the 'cmd.cgi' endpoint. When the Cookie header is missing, the double-submit cookie protection mechanism ca...

CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

This module enables site administrators to require CAPTCHA confirmation on specific pages. The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirel...

Linux Distros Unpatched Vulnerability : CVE-2026-16434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard...

Linux Distros Unpatched Vulnerability : CVE-2026-48549

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie...

Linux Distros Unpatched Vulnerability : CVE-2026-74752

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled...

Linux Distros Unpatched Vulnerability : CVE-2026-34959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVERREQUESTURI with no trusted-proxy check and no validation of the pref...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098739)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098739 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctpunpackcookie only...

PT-2026-82371

Name of the Vulnerable Software and Affected Versions CAPTCHA Protected Page versions 0.0.0 through 1.0.2 Description An authentication bypass exists in the CAPTCHA Protected Page module, which allows site administrators to require CAPTCHA confirmation on specific pages. The module fails to...