CVE-2026-91204

The documents provide conflicting information regarding CVE-2026-91204 . The Initial document describes a Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 , where an anonymous remote attacker can store a comment containing a javascript: URI. This occurs specifically when users.comm...

CVE-2026-91206 Apache Roller: Reflected XSS in the optional LDAP comment authenticator

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping...

CVE-2026-100655

A flaw was found in Netty. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exhausting server memory. Because the SPDY session handler does not restrict the number of concurrent streams initiated by a remote peer, an attacker can transmit an excessive volume of stre...

CVE-2026-84652

A flaw was found in Jenkins. When a user authenticates using the "remember me" cookie, Jenkins fails to rotate the session identifier. This oversight allows a remote attacker, who can serve content on the same site as Jenkins, to set a known session cookie in a victim's browser. Consequently, onc...

CVE-2026-59739

A flaw was found in Apache ZooKeeper. This vulnerability allows a remote attacker to discover paths that should be restricted by Access Control Lists ACLs. By registering watches on non-existent paths and then reconnecting after these paths are created with restricted ACLs, the attacker can bypas...

ROS-20260928-73-0013

The vulnerability of the copyfromuser and copytouser functions in the arch/sparc/lib/U1memcpy.S module of the Linux operating system is related to the lack of checking the return value. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2026-52749: Improper Authentication

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perfor...

Important: webkitgtk4

Issue Overview: Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High CVE-2026-85049 Affected Packages: webkitgtk4 Note: This advisory is applicable to Amazon...

CVE-2026-78677

A flaw was found in GitPython. This vulnerability allows a remote attacker to create arbitrary Git directories outside the intended clone destination. By manipulating the separategitdir parameter during repository cloning, an attacker can redirect repository metadata to an attacker-controlled...

CVE-2026-100724 http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy

http4k Maven package org.http4k:http4k-core before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring Contains matching on the Host header by default in reverseProxy and reverseProxyRouting when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP...

CVE-2026-100724 http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy

http4k Maven package org.http4k:http4k-core before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring Contains matching on the Host header by default in reverseProxy and reverseProxyRouting when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP...

CVE-2026-100724

The http4k library (Maven package org.http4k:http4k-core) versions prior to 6.49.0.0 , 5.42.0.0 , and 4.51.0.0 are vulnerable to a Host Header Routing Bypass in the reverseProxy() and reverseProxyRouting() functions. The root cause is the use of substring (Contains) matching on the Host header wh...

CVE-2026-100672 grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-87506

openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the agent's normal tool authority to a remote caller...

hono: hono/jsx: Cross-Site Scripting via Unescaped Strings

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

CVE-2026-84332

A flaw was found in Google Chrome. This incorrect authorization vulnerability in SiteSettings allows a remote attacker to bypass system access restrictions by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to sensitive system configurations...

CVE-2026-84331

A flaw was found in chromium-browser. This incorrect authorization vulnerability allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy by using a specially crafted HTML page. This could lead to unauthorized access to data or functionality acro...

CVE-2026-78897

A flaw was found in BrowserTag in Google Chrome. Missing authorization allows a remote attacker, leveraging social engineering, to obtain sensitive information by using a specially crafted Chrome extension...

CVE-2026-79125

A flaw was found in Google Chrome. This information leak vulnerability, specifically within the XR component, allows a remote attacker to obtain sensitive information. The attacker can achieve this by enticing a user to visit a specially crafted HTML page. This could lead to the unauthorized...