PT-2026-96694

Name of the Vulnerable Software and Affected Versions open-vsx.org affected versions not specified Description The deployment of the service returned an Access-Control-Allow-Origin header that reflected the requesting origin combined with Access-Control-Allow-Credentials: true on authenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-85717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and fr...

CVE-2026-77912: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

The vulnerability of the contact search component of the SOGo software for collaborative work lies in the lack of a password recovery mechanism, allowing attackers to gain unauthorized access to users’ accounts.

The vulnerability of the contact search component in the SOGo software for collaborative work is related to the lack of a password recovery mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to a user’s account through specially craft...

CVE-2026-93340

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

CVE-2026-59814

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resourceid= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A...

CVE-2026-46650

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character...

CVE-2026-93340 Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

CVE-2026-93340 Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

CVE-2026-93340 Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

CVE-2026-46650 Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character...

CVE-2026-46650

Joplin (open-source note-taking app) prior to 3.7.2 contains a stored XSS in the public share viewer. The root cause is an unanchored regular expression in isAcceptedUrl() (packages/renderer/htmlUtils.ts) that allows a javascript: URL containing a matching 32-character path fragment to pass valid...

CVE-2026-59814

Joplin Server prior to version 3.7.7 is vulnerable to stored XSS via the GET /shares/:id?resource_id= route. When a resource has an empty title, the server serves it with an attacker-controlled MIME type and omits Content-Disposition, allowing a low-privileged user to publish an image/svg+xml att...

CVE-2026-59814 Joplin: Stored XSS via inline-served note attachment on published shares

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resourceid= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A...

CVE-2026-59814 Joplin: Stored XSS via inline-served note attachment on published shares

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resourceid= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A...

CVE-2026-73546

Envoy 's /stats?format=html admin endpoint is vulnerable to stored XSS because StatsHtmlRender sanitizes statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can embed attacker-controlled path segments into ...

smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability

A flaw was found in Skia, a 2D graphics library used in Google Chrome. A remote attacker, after compromising the renderer process, could exploit a use-after-free vulnerability by crafting a malicious HTML page. This could allow the attacker to obtain sensitive cross-origin data...