Squid Proxy - HTTP Authentication Credentials Disclosure

Squid versions prior to 7.2 fail to redact HTTP authentication credentials in error page responses. The Authorization header value is embedded in plain text inside the mailto: diagnostic block when Squid generates an error page e.g. ERRDNSFAIL. id: CVE-2025-62168 info: name: Squid Proxy - HTTP...

CLEANSTART-2024-SU55971 XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar

Security vulnerability affects the librewolf package. An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar...

CLEANSTART-2024-AY27811 If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown

CVE-2022-34472 affects multiple packages. If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown. See references for individual vulnerability details...

CLEANSTART-2024-TP18140 XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar

Security vulnerability affects the firefox package. An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar...

Linux Distros Unpatched Vulnerability : CVE-2026-57196

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11...

CVE-2026-57196 Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in phone provisioning HTTP error pages to retrieve an...

CVE-2026-57196 Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in phone provisioning HTTP error pages to retrieve an...

CVE-2026-57196

Asterisk, an open source telephony toolkit, is vulnerable to reflected cross-site scripting (XSS) in phone provisioning HTTP error pages prior to versions 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3 . An unauthenticated attacker could potentially retrieve an a...

CVE-2026-57196 Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in phone provisioning HTTP error pages to retrieve an...

Asterisk cross-site scripting vulnerability

Versions prior to Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as Certified Asterisk versions prior to 20.7-cert11 and 22.8-cert3, contain a cross-site scripting vulnerability. This vulnerability arises from reflected XSS in HTTP error pages configured for telephony. When resphoneprov,...

PT-2026-125101

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in phone provisioning HTTP error pages to retrieve an...

Astra Linux – Vulnerability in Firefox, Thunderbird

If a PAC URL was set, and the server hosting the PAC was unreachable, OCSP requests would be blocked, resulting in incorrect error pages being displayed. This vulnerability affects Firefox 102, Firefox ESR 91.11, Thunderbird 102, and Thunderbird 91.11...

📄 DjangoCRM 2.4.0 Debug Information Disclosure

A proof of concept exploit for an information disclosure vulnerability in DjangoCRM version 2.4.0. The vulnerability exists because affected installations ship with Django debug mode enabled, allowing unauthenticated attackers to trigger technical error pages that disclose sensitive application...

CVE-2026-66296

Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...

CVE-2026-66296 Reflected XSS in oaskit's default HTML error handler

Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...

EUVD-2026-40458

Storage Concentrator SC & SCVM is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an authenticated user, causes arbitrary script content to execute within the victim's browser...

CVE-2026-50040

Storage Concentrator SC & SCVM is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an authenticated user, causes arbitrary script content to execute within the victim's browser...

CVE-2026-50040 Cross-site Scripting in StoneFly Storage Concentrator

Storage Concentrator SC & SCVM is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an authenticated user, causes arbitrary script content to execute within the victim's browser...

CVE-2026-50040 Cross-site Scripting in StoneFly Storage Concentrator

Storage Concentrator SC & SCVM is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an authenticated user, causes arbitrary script content to execute within the victim's browser...

CVE-2026-50040: Improper Neutralization of Input During Web Page Generation

Storage Concentrator SC & SCVM is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an authenticated user, causes arbitrary script content to execute within the victim's browser...