EUVD-2026-85786

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149: Incomplete List of Disallowed Inputs

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

Astra Linux – Vulnerability in tar

GNU Tar version 1.34 has a one-byte out-of-bounds read operation that allows for the use of uninitialized memory during a conditional jump. Exploitation to alter the control flow has not been demonstrated. The issue occurs in the fromheader section of the list.c file, due to a V7 archive where...

CVE-2026-73524

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-73524

CVE-2026-73524 is a cross-site scripting (XSS) vulnerability in Cypht (versions before 2.12.2 ), located in the contacts module . The root cause is a flawed sanitization routine that removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact. An at...

PT-2026-84466

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101105)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101105 advisory. Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header...

CVE-2026-71192

A flaw was found in the S3API middleware of OpenStack Swift. When configured with s3acl=true non-default, Swift-native control headers such as X-Copy-From and X-Copy-From-Account are not sanitized from S3 API requests. Because the S3 ACL mode bypasses Swift's native authorization, an authenticate...

CVE-2026-71192

In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests when s3acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a...

CVE-2026-71192

In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests when s3acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a...

CVE-2026-38444

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting XSS via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ostthreadentry. When an unauthenticated attacker sends a reply email to an...

CVE-2026-38444: Improper Neutralization of Input During Web Page Generation

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting XSS via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ostthreadentry. When an unauthenticated attacker sends a reply email to an...

PT-2026-67465

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting XSS via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ost thread entry. When an unauthenticated attacker sends a reply email to an...

CVE-2026-38444

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting XSS via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ostthreadentry. When an unauthenticated attacker sends a reply email to an...

CVE-2026-38444

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting XSS via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ostthreadentry. When an unauthenticated attacker sends a reply email to an...

CVE-2026-38444

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting XSS via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ostthreadentry. When an unauthenticated attacker sends a reply email to an...

EUVD-2026-52404

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting XSS via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ostthreadentry. When an unauthenticated attacker sends a reply email to an...

CVE-2026-38444

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting XSS via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ostthreadentry. When an unauthenticated attacker sends a reply email to an...

CVE-2026-38444

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability exists because the From-header display name in email replies is extracted without sanitization in include/class.mailparse.php and stored raw in...

CVE-2026-57511 SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SM...