CVE-2026-82726

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

CVE-2026-82726 AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

EUVD-2026-68304

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

CVE-2026-81315

CVE-2026-81315 is an origin validation error in ash-project ash_ai (affecting AshAi.Mcp.Server), allowing a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server using that user's actor. The root cause lies in origin_allo...

CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

EEF-CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Summary Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil,...

CVE-2026-82726: Permissive Regular Expression

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

PT-2026-84048

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description An issue exists in the MediaStreamController.php file where the /media/id/download/slug endpoint and its administration variant honor the inline query parameter for...

PT-2026-83644

Origin Validation Error vulnerability in ash-project ash ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowed origins: nil, origin...

Debian dla-4762 : libarchive-dev - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4762 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4762-1 [email protected]...

Linux Distros Unpatched Vulnerability : CVE-2026-59314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file...

Linux Distros Unpatched Vulnerability : CVE-2026-47892

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...

Linux Distros Unpatched Vulnerability : CVE-2026-82661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message header...

PT-2026-83690

Permissive Regular Expression vulnerability in ash-project ash phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.get subdomain/2 stripped the root domain with String.replacehost, r/.?root host/, ""...

Linux Distros Unpatched Vulnerability : CVE-2026-80599

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: dat: ensure accessible ethhdr proto field When batadvgetvid accesses the proto field of the ethernet header, it is not checking if the data itself i...

PT-2026-83726

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list..comment parameters can inject CRLF sequences to create additional headers in generated RFC822...

CVE-2026-82644 WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

CVE-2026-82644 WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

CVE-2026-14835 SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...