EUVD-2026-102783

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woofsettingswoofstatserveroptions' parameter. This makes it possible for unauthenticated attackers to extract the...

CVE-2026-107646 HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woofsettingswoofstatserveroptions' parameter. This makes it possible for unauthenticated attackers to extract the...

CVE-2026-111450

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request...

AZL-109532 CVE-2026-111450 affecting package python-wheel 0.43.0-2

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request...

CVE-2026-18660

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to bypass access controls and reach restricted resources. The issue occurs because the server and proxy components perform case-sensitive validation on host allowlists and denylists. By sending requests with altered...

CVE-2026-111450

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request...

EUVD-2026-102603

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request...

CVE-2026-111450

The Wheels framework (versions through 4.1.1 ) is vulnerable to an issue where it derives the default production error-email address from the Host header of the initial request starting the application. If an explicit recipient is not configured and a mail server is active, an attacker can trigge...

CVE-2026-111450

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request...

CVE-2026-111450

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request...

CVE-2026-111450

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request...

CVE-2026-111385

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

CVE-2026-111385 Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

CVE-2026-111385 Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

CVE-2026-111385

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

CVE-2026-111385 Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

EUVD-2026-102566

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

CVE-2026-111385

Nezha versions 2.1.0 before 2.3.15 are vulnerable to a Host Header Injection in the mintTransferTool component. The vulnerability occurs because the application builds fs.download_url and fs.upload_url transfer URLs using an unvalidated Host header . An attacker controlling the Host header in a v...

EUVD-2026-102523

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

PT-2026-115391

Name of the Vulnerable Software and Affected Versions Nezha versions 2.1.0 through 2.3.14 Description The mintTransferTool component fails to validate the Host header when constructing fs.download url and fs.upload url transfer URLs. This allows an attacker to control the Host header in a victim'...