CVE-2026-18516

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...

CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...

CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...

CVE-2026-18516

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...

CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...

EUVD-2026-102873

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...

CVE-2026-18516

The Audit Logs component of Crafty Controller is vulnerable to an output escaping flaw (CWE-116 ). A remote, unauthenticated attacker can perform stored cross-site scripting (XSS) by leveraging HTTP header injection . No specific remediation or exploit details are provided in the documents.

CVE-2026-18516: Improper Encoding or Escaping of Output

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...

PT-2026-115610

Name of the Vulnerable Software and Affected Versions Crafty Controller affected versions not specified Description An output escaping issue in the Audit Logs component allows a remote, unauthenticated attacker to execute stored cross-site scripting XSS through HTTP header injection. Cross-site...

SUSE CVE-2026-110835

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-84731

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters...

CVE-2026-84731

An unauthenticated remote attacker can achieve a pre-authentication admin bypass and Remote Code Execution (RCE) in the Nutanix Prism Gateway inside AOS . The root cause is a misconfiguration in the application's authentication filters, which allows an attacker to include a crafted internal manag...

CVE-2026-84731 Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters...

Arcadia Technology Crafty Controller has a vulnerability related to improper output processing

The Arcadia Technology Crafty Controller 4.10.8 and earlier versions have a vulnerability in output processing. This vulnerability stems from improper output escaping in the Audit Logs component. A remote, unauthenticated attacker can execute a stored-xss attack through HTTP header injection...

CVE-2026-110835

A flaw was found in FreeRDP. A remote, unauthenticated attacker can perform HTTP header injection by submitting a routing token containing an unvalidated line feed character to a FreeRDP proxy configured with dynamic targets and an upstream Hypertext Transfer Protocol HTTP proxy. This vulnerabili...

EUVD-2026-101718

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

UBUNTU-CVE-2026-110835

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-84731: Missing Authentication for Critical Function

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters...

Linux Distros Unpatched Vulnerability : CVE-2026-110835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected a...

CVE-2026-110865

A flaw was found in Renovate. This vulnerability allows an authenticated repository user to bypass HTTP Hypertext Transfer Protocol header restrictions by specifying custom headers within shared configuration presets. By injecting arbitrary headers into outbound requests sent by Renovate, an...