CLEANSTART-2026-KS26010 flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Acces...

Security vulnerability affects the wildfly package. A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true...

PT-2026-102815

Name of the Vulnerable Software and Affected Versions JupyterLab versions 3.0.0 through 4.5.10 JupyterLab versions 4.6.0 through 4.6.3 JupyterLite Core versions 0.x through 0.8.3 Description An issue exists where the Plural-Forms header in selected third-party language packs can append JavaScript...

Important: kernel6.18

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft CVE-2026-80844 In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom CVE-2026-81000 Affected Packages: kernel6.18 Issu...

PT-2026-102728

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...

Fedora 44 : perl-Catalyst-Plugin-Static-Simple (2026-2d96cf2594)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2d96cf2594 advisory. Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static asset served. Consequently, intermediaries such as shared...

CVE-2026-53989: URL Redirection to Untrusted Site

Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to redirect authenticated users to attacker-controlled sites by injecting an unvalidated redirect query parameter. Attackers can craft a malicious link...

PT-2026-102507

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2026-41875: Cross-Site Request Forgery (CSRF)

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft CVE-2026-80844 In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom CVE-2026-81000 Affected Packages: kernel Issue...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3102)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3102 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft CVE-2026-80844 In the Linux kernel, the following vulnerability has been...

PT-2026-102764

Name of the Vulnerable Software and Affected Versions NetX RTSP Server affected versions not specified Description An unauthenticated client can cause a denial of service by draining the RTSP server's packet pool. This occurs when requests are sent containing a Session header that the parser cann...

CVE-2026-102830: Improper Neutralization of Input During Web Page Generation

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...

CVE-2026-102716: Missing Release of Memory after Effective Lifetime

An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: c / addons/rtsp/nxrtspserver.c:2754 / status =...

Linux Distros Unpatched Vulnerability : CVE-2026-100888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0. This affects the function dkimcanonselecthdrs of the file libopendkim/dkim-canon...

Debian dsa-6529 : libwebsockets-dev - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6529 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6529-1 [email protected] https://www.debian.org/security/ Moritz...

SUSE CVE-2026-67421

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an...

SUSE CVE-2026-93682

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

SUSE CVE-2026-97964

In the Linux kernel, the following vulnerability has been resolved: pppsynctty: ensure a writeable skb header pppsynctxmunge checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP...

SUSE CVE-2026-100888

A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0. This affects the function dkimcanonselecthdrs of the file libopendkim/dkim-canon.c of the component DKIM Signature Header Selection. Executing a manipulation of the argument h can lead to out-of-bounds write. The atta...

CVE-2026-102275 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.fromjwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding ...