GHSA-H4X7-GW46-3WM6 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

Summary HTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...

EUVD-2026-70246

HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.12 Vulnerability Details CVEID:CVE-2026-2303 DESCRIPTION: The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS. The C wrapper implementation contains a heap...

NewStart CGSL MAIN 7.02 : busybox Multiple Vulnerabilities (NS-SA-2026-0087)

The remote NewStart CGSL host, running version MAIN 7.02, has busybox packages installed that are affected by multiple vulnerabilities: - BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal...

CVE-2026-82756 ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

CVE-2026-82756 ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

CVE-2026-82756 ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-0865 DESCRIPTION: User-controlled header names and values containing newlines can allow injecting HTTP headers. CWE:CWE-74: Improper Neutralization of...

CVE-2026-19862

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...

CVE-2026-19862 JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...

WordPress JetFormBuilder plugin < 3.6.5.2 - Unauthenticated Email Header Injection vulnerability

Unauthenticated Email Header Injection vulnerability discovered by Emirhan Kurt in WordPress Plugin JetFormBuilder versions 3.6.5.2...

CVE-2026-19862 JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...

CVE-2026-19862

JetFormBuilder WordPress plugin versions before 3.6.5.2 are vulnerable to unauthenticated email header injection via the Send Email action. The root cause is that the plugin does not validate or strip line breaks from address values sourced from submitted form fields before including them in outg...

PT-2026-86505

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...

SUSE CVE-2026-84379

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

BIT-JOOMLA-2026-71572 Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260801 - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libevent (UTSA-2026-106162)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106162 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes...

libevent: Libevent: HTTP header handling bugs create risk of access control bypass.

A flaw was found in libevent. The evhttpdecodeuriinternal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes...

SUSE-SU-2026:3930-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: - CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response...

SUSE-SU-2026:3929-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: - CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response...