10636 matches found
PT-2026-99382
Name of the Vulnerable Software and Affected Versions froxlor versions prior to 2.3.12 Description The software fails to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. This allows attackers who possess hijacked sessions, valid API keys, or 2FA...
CVE-2026-100379
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main...
CVE-2026-100379
The Wikipedia Android App (main component) is vulnerable to an Exposure of Sensitive Information flaw. This vulnerability allows an unauthorized actor to access, intercept, or modify HTTP cookies , specifically resulting in the cross-request disclosure of CentralAuth cookies . No specific exploit...
EUVD-2026-87344
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main...
CVE-2026-97952 sunvdc: unmap LDC cookies when the descriptor send fails
In the Linux kernel, the following vulnerability has been resolved: sunvdc: unmap LDC cookies when the descriptor send fails sendrequest maps the request's pages into the LDC channel's map table ldcmapsg, fills in the descriptor and marks it VIODESCREADY before ringing the doorbell via...
CVE-2026-97952 sunvdc: unmap LDC cookies when the descriptor send fails
In the Linux kernel, the following vulnerability has been resolved: sunvdc: unmap LDC cookies when the descriptor send fails sendrequest maps the request's pages into the LDC channel's map table ldcmapsg, fills in the descriptor and marks it VIODESCREADY before ringing the doorbell via...
CVE-2026-97952
In the Linux kernel, the following vulnerability has been resolved: sunvdc: unmap LDC cookies when the descriptor send fails sendrequest maps the request's pages into the LDC channel's map table ldcmapsg, fills in the descriptor and marks it VIODESCREADY before ringing the doorbell via...
CVE-2026-100379: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main...
PT-2026-99123
Name of the Vulnerable Software and Affected Versions Wikimedia Foundation Wikipedia Android App affected versions not specified Description An issue exists that allows an unauthorized actor to access, intercept, or modify HTTP cookies, leading to the exposure of sensitive information...
USN-8820-1: curl vulnerabilities
Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for LDAP authentication in certain circumstances. A machine-in-the-middle attacker could possibly use this issue to bypass peer validation. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. CVE-2026-13608 Stephan...
Astra Linux – Vulnerability in Chromium
Improper input validation in Cookies in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...
PT-2026-97804
Name of the Vulnerable Software and Affected Versions Aureus ERP versions prior to 1.6.1 Description The application stores uploaded SVG files on its public disk and serves them from the application origin. This allows authenticated users to upload malicious SVG files containing JavaScript...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124487)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124487 advisory. Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as a=...
CVE-2026-18165
A flaw was found in @fastify/oauth2, an OAuth 2.0 plugin for Fastify. This vulnerability allows a remote attacker to perform a Login Cross-Site Request Forgery CSRF attack. By planting predictable OAuth state and code verifier cookies, an attacker can trick a victim's browser into completing an...
PT-2026-96722
Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A reflected cross-site scripting XSS issue exists in the attribute histogram view. The $selectedTypes variable, derived from the URL path segment, is interpolated directly into a JavaScript arra...
CVE-2026-58504
CVE-2026-58504 is a Stored XSS in draw.io prior to version 30.2.5 , constituting a patch bypass of CVE-2026-46642 . When a victim opens or imports a crafted .drawio file, a pair of sibling cells triggers the vulnerability: an HTML cell keeps the formatted-label path active while an editable=0 pla...
Security Bulletin: Multiple vulnerabilities impacts AIX due to cURL libcurl.
Summary Multiple vulnerabilities in the curl/libcurl are related to reuse existing unencrypted connection CVE-2026-4873, credentials leakage CVE-2026-6253, CVE-2026-6429, CVE-2026-7168, cookies leakageCVE-2026-6276. Vulnerability Details CVEID:CVE-2026-4873 DESCRIPTION: A vulnerability exists whe...
curl: curl: Cookie injection via malicious HTTP server using super cookies
A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to...
ALSA-2026:69125 Important: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: curl: Information...