PT-2026-69463

Name of the Vulnerable Software and Affected Versions NASA HyperCP main branch Description An OS command injection issue exists where a network-adjacent attacker can execute arbitrary system commands on a researcher's workstation by intercepting or spoofing responses from the...

PT-2026-69951

Name of the Vulnerable Software and Affected Versions MaaS API affected versions not specified Description A flaw in the MaaS API allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway. This occurs because the system trusts the X-MaaS-Username and X-MaaS-Group HTTP headers...

PT-2026-69699

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vmxnet3 get hdr len function where it incorrectly assumes that gdesc-rcd.v4, gdesc-rcd.v6, and gdesc-rcd.tcp always describe the outer header. For...

PT-2026-69370

Name of the Vulnerable Software and Affected Versions Login & Register Forms versions prior to 4.0.2 Description An issue exists where the password reset verification state is not bound to the account being reset or the party completing the verification. Instead, the state is keyed on a value...

CVE-2026-14450: Authentication Bypass by Spoofing

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically X-MaaS-Username and X-MaaS-Group, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain...

CVE-2026-72574: Improper Neutralization of HTTP Headers for Scripting Syntax

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

CVE-2026-19362

A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function parsetokenfromheader of the file src/parsetokenfromheader.rs of the component Authorization Header Parsing. The manipulation of the argument authorizationtoken leads to denial of service. Remote...

CVE-2026-19362

The CVE-2026-19362 affects lmammino oidc-authorizer 0.4.0. It concerns the function parse_token_from_header in src/parse_token_from_header.rs of the Authorization Header Parsing component, where manipulation of the authorization_token argument can cause a denial of service. Remote exploitation is...

CVE-2026-19362 lmammino oidc-authorizer Authorization Header Parsing parse_token_from_header.rs parse_token_from_header denial of service

A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function parsetokenfromheader of the file src/parsetokenfromheader.rs of the component Authorization Header Parsing. The manipulation of the argument authorizationtoken leads to denial of service. Remote...

EUVD-2026-54933

A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function parsetokenfromheader of the file src/parsetokenfromheader.rs of the component Authorization Header Parsing. The manipulation of the argument authorizationtoken leads to denial of service. Remote...

CVE-2026-19362 lmammino oidc-authorizer Authorization Header Parsing parse_token_from_header.rs parse_token_from_header denial of service

A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function parsetokenfromheader of the file src/parsetokenfromheader.rs of the component Authorization Header Parsing. The manipulation of the argument authorizationtoken leads to denial of service. Remote...

CVE-2026-19362

A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function parsetokenfromheader of the file src/parsetokenfromheader.rs of the component Authorization Header Parsing. The manipulation of the argument authorizationtoken leads to denial of service. Remote...

MGASA-2026-0327 Updated python-starlette package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Proxy-Authorization header kept across hosts. CVE-2024-28849 Starlette vulnerable to On^2 DoS via Range header merging in starlette.responses.FileResponse. CVE-2025-62727 Security restriction bypass via malformed HTTP Host header. CVE-2026-48710...

Updated python-starlette package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Proxy-Authorization header kept across hosts. CVE-2024-28849 Starlette vulnerable to On^2 DoS via Range header merging in starlette.responses.FileResponse. CVE-2025-62727 Security restriction bypass via malformed HTTP Host header. CVE-2026-48710...

PT-2026-69303

Name of the Vulnerable Software and Affected Versions lmammino oidc-authorizer version 0.4.0 Description A flaw in the Authorization Header Parsing component allows remote attackers to cause a denial of service. The issue occurs within the parse token from header function located in the src/parse...

CVE-2026-19362: Improper Resource Shutdown or Release

A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function parsetokenfromheader of the file src/parsetokenfromheader.rs of the component Authorization Header Parsing. The manipulation of the argument authorizationtoken leads to denial of service. Remote...

SUSE CVE-2026-46405

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...

CVE-2026-42170 Gimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_layer() (ddsread.c)

A heap-based buffer overflow vulnerability exists in the GIMP DDS DirectDraw Surface file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel bpp value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the...

EUVD-2026-54727

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordionheaderrenderer function, which emits the...

CVE-2026-18988

The CVE-2026-18988 entry concerns the Easy Accordion plugin for WordPress, affected in versions up to and including 3.1.8. The underlying issue is insufficient input sanitization and output escaping in accordion_header_renderer(), which emits attacker-supplied tag names using esc_attr() in an HTM...