CVE-2026-41875 Cross-Site Request Forgery in admin panel of Quick.Cart

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2026-41875

The Quick.Cart software contains a Cross-Site Request Forgery (CSRF) vulnerability within the admin config panel . An attacker can craft a malicious website that, when visited by an administrator, automatically sends a POST request to modify the administrator's login credentials and password. Whi...

EUVD-2026-88741

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2026-41875 Cross-Site Request Forgery in admin panel of Quick.Cart

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

Exploit for Integer Underflow (Wrap or Wraparound) in Microsoft

CVE-2024-38063: Exploitation, Detection & Mitigation Lab O...

CVE-2026-77756

A flaw was found in Apache Tomcat. This vulnerability, known as HTTP Request/Response Smuggling, occurs when Tomcat processes the transfer-encoding header for an HTTP/1.0 request while operating behind a reverse proxy. A remote attacker could exploit this to cause a denial of service, leading to...

BIT-ENVOY-2026-73552 Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates saferegex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibit...

BIT-ENVOY-2026-73550 Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...

CLEANSTART-2026-FK35606 undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1

Security vulnerability affects the langfuse package. undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1...

CLEANSTART-2026-XL00241 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header

Security vulnerability affects the langfuse package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...

CLEANSTART-2026-LT41646 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request

Security vulnerability affects the apache-hive package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...

CLEANSTART-2026-VD50036 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name

Security vulnerability affects the apache-hive package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...

CLEANSTART-2026-UD61753 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Security vulnerability affects the argo-workflows package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...

CLEANSTART-2026-PQ26679 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

Security vulnerability affects the kafka package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...

CLEANSTART-2026-WU74095 hpack is an HTTP/2 Header Encoding for Python

Security vulnerability affects the airflow-3 package. hpack is an HTTP/2 Header Encoding for Python...

CLEANSTART-2026-KK42580 flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value

Security vulnerability affects the spark-sc212-jdk17-py311 package. A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value...

CLEANSTART-2026-KS26010 flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Acces...

Security vulnerability affects the wildfly package. A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true...

PT-2026-102815

Name of the Vulnerable Software and Affected Versions JupyterLab versions 3.0.0 through 4.5.10 JupyterLab versions 4.6.0 through 4.6.3 JupyterLite Core versions 0.x through 0.8.3 Description An issue exists where the Plural-Forms header in selected third-party language packs can append JavaScript...

Important: kernel6.18

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft CVE-2026-80844 In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom CVE-2026-81000 Affected Packages: kernel6.18 Issu...

PT-2026-102728

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...