K000163569: Multiple Apache Tomcat vulnerabilities

Security Advisory Description CVE-2026-75973 Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to...

@coveo/atomic (>=3.61.2, <=3.61.3), @coveo/atomic-angular (>=3.11.25, <=3.11.26) +13 more potentially affected by CVE-2026-105800 via i18next-http-backend (>=4.0.0, <=4.0.1)

i18next-http-backend NPM version =4.0.0, =3.61.2, =3.11.25, =3.11.42, =3.11.42, =3.61.2, =3.11.42, =3.61.2, =1.0.0-rc.6, =1.15.0, =1.6.1, =5.0.0, =10.0.0, =3.0.0, =3.0.5 - zhiyu-hands 1.14.0 Source cves: CVE-2026-105800 Source advisory: OSV:GHSA-XVQ9-WJP8-HWQF...

GHSA-XVQ9-WJP8-HWQF i18next-http-backend incomplete URL validation permits SSRF

There is an SSRF vulnerability when using i18next-http-backend. A colon in an attacker-controlled language value can make a custom path template request an unintended origin. This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolat...

i18next-http-backend incomplete URL validation permits SSRF

There is an SSRF vulnerability when using i18next-http-backend. A colon in an attacker-controlled language value can make a custom path template request an unintended origin. This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolat...

NPM: i18next-http-backend incomplete URL validation permits SSRF

NPM: i18next-http-backend incomplete URL validation permits SSRF vulnerability discovered by ? in WordPress Npm i18next-http-backend versions 4.0.2...

@coveo/atomic (>=3.61.2, <=3.61.3), @coveo/atomic-angular (>=3.11.25, <=3.11.26) +13 more potentially affected by CVE-2026-105800 via i18next-http-backend (>=4.0.0, <=4.0.1)

i18next-http-backend NPM version =4.0.0, =3.61.2, =3.11.25, =3.11.42, =3.11.42, =3.61.2, =3.11.42, =3.61.2, =1.0.0-rc.6, =1.15.0, =1.6.1, =5.0.0, =10.0.0, =3.0.0, =3.0.5 - zhiyu-hands 1.14.0 Source cves: CVE-2026-105800 Source advisory: SNYK:JS-I18NEXTHTTPBACKEND-20580644...

@coveo/atomic (>=3.61.2, <=3.61.3), @coveo/atomic-angular (>=3.11.25, <=3.11.26) +13 more potentially affected by CVE-2026-105800 via i18next-http-backend (>=4.0.0, <=4.0.1)

i18next-http-backend NPM version =4.0.0, =3.61.2, =3.11.25, =3.11.42, =3.11.42, =3.61.2, =3.11.42, =3.61.2, =1.0.0-rc.6, =1.15.0, =1.6.1, =5.0.0, =10.0.0, =3.0.0, =3.0.5 - zhiyu-hands 1.14.0 Source cves: CVE-2026-105800 Source advisory: GHSA-XVQ9-WJP8-HWQF...

Server-side Request Forgery (SSRF)

Overview i18next-http-backend is an i18next-http-backend is a backend layer for i18next using in Node.js, in the browser and for Deno. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via insufficient validation in isSafeUrlSegment functions in lib/utils.js,...

DEBIAN-CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

UBUNTU-CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

OPENSUSE-SU-2026:22035-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276744. - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue...

SUSE-SU-2026:24150-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276744. - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue...

CVE-2026-105800

The i18next-http-backend library, used for loading translation resources in Node.js , browsers , and Deno , is vulnerable to Server-Side Request Forgery (SSRF) and URL injection prior to version 4.0.2 . The root cause is incomplete URL validation where attacker-controlled language or namespace va...

CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

@coveo/atomic (>=3.61.2, <=3.61.3), @coveo/atomic-angular (>=3.11.25, <=3.11.26) +13 more potentially affected by CVE-2026-105800 via i18next-http-backend (>=4.0.0, <=4.0.1)

i18next-http-backend NPM version =4.0.0, =3.61.2, =3.11.25, =3.11.42, =3.11.42, =3.61.2, =3.11.42, =3.61.2, =1.0.0-rc.6, =1.15.0, =1.6.1, =5.0.0, =10.0.0, =3.0.0, =3.0.5 - zhiyu-hands 1.14.0 Source cves: CVE-2026-105800 Source advisory: MEND:CVE-2026-105800...

EUVD-2026-93433

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...