CVE-2026-25275

Transient DOS when processing authentication frames with invalid FILS information element header lengths...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

CVE-2026-25275 Buffer Over-read in WLAN Firmware

Transient DOS when processing authentication frames with invalid FILS information element header lengths...

CVE-2026-89064 All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

CVE-2026-89064 All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

CVE-2026-86049: Insertion of Sensitive Information into Log File

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

CVE-2026-85715: Memory Allocation with Excessive Size Value

ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop...

Fedora 43 : roundcubemail (2026-821349f438)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-821349f438 advisory. Release 1.6.19 - Fix PHP Warning: Undefined variable $tmpcommand in .../plugins/markasjunk/drivers/cmdlearn.php 10294 - Security: Fix CSS declaration smuggli...

PT-2026-94835

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the RDMA/hfi1 component, the function set txreq header ahg fails to check the return value of sdma txinit ahg. When sdma txinit ahg fails, it returns before initializing tx-txreq, but...

PT-2026-94341

Name of the Vulnerable Software and Affected Versions SmallRye JWT affected versions not specified Description A flaw exists in the AwsAlbKeyResolver of SmallRye JWT, used for verifying JSON Web Tokens signed by AWS Application Load Balancers. When the AWS ALB key provider is active, the resolver...

CVE-2026-54649: Exposure of Sensitive Information to an Unauthorized Actor

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...

PT-2026-95067

Name of the Vulnerable Software and Affected Versions punchin-email versions prior to 1.5.0 Description punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. The handleInbound function delivers inbound alias mail using message.forwar...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-109810)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109810 advisory. When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-109803)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109803 advisory. The email module, specifically the BytesGenerator class, didnt properly quote newlines for email headers when serializing an email message allowing for header...

EulerOS 2.0 SP15 : perl-libwww-perl (EulerOS-SA-2026-3815)

According to the versions of the perl-libwww-perl package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross- origin redirects.x000D x000D On...

PT-2026-95109

Name of the Vulnerable Software and Affected Versions Jupyter Server versions prior to 2.21.0 Description In the 5xx request logging path within jupyter server/log.py, the Referer header is copied into a JSON header block without applying the token scrubbing typically used for the request URI. Wh...

CVE-2026-86863: Authentication Bypass by Spoofing

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.getuser read config.WEBSERVERREMOTEUSER from request.environ and, when that returned...

PT-2026-94353

Name of the Vulnerable Software and Affected Versions Sanic versions prior to 24.12.1 Sanic version 25.12.0 Description The HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. This allows...

Linux Distros Unpatched Vulnerability : CVE-2026-64684

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in...

EulerOS 2.0 SP15 : python-pip (EulerOS-SA-2026-3818)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...