CVE-2026-108103: Out-of-bounds Read

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsedroppeddltrafficthreshold that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 wi...

Linux Distros Unpatched Vulnerability : CVE-2026-107399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in...

CVE-2026-71575: Insufficient Session Expiration

The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-...

LiteLLM < 1.84.0 Improper Authentication Vulnerability (GHSA-7488-6r32-c95q)

The version of the LiteLLM Python package installed on the remote host is prior to 1.84.0. It is, therefore, affected by a vulnerability: - LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint. When LiteLLM key validation fails, the fallback OAuth2...

CVE-2026-107715

A flaw was found in mechanize. The library fails to strip caller-supplied credential headers when following cross-origin Hypertext Transfer Protocol HTTP redirects. A remote attacker who controls the target server of a redirect can exploit this vulnerability to capture sensitive authentication...

CVE-2026-107399

A flaw was found in mechanize. When automatic meta refresh following is enabled, the library fails to restrict request headers across different web domains during a redirect. A remote attacker who controls web content during a crawl can redirect requests to an untrusted destination, leading to...

DEBIAN-CVE-2026-107715

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanizerequestheaders= is reapplied by Mechanize::HTTP::Agentrequestaddheaders even after...

CVE-2026-107715

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanizerequestheaders= is reapplied by Mechanize::HTTP::Agentrequestaddheaders even after...

DEBIAN-CVE-2026-107399

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

CVE-2026-107399

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

CVE-2026-107399

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

UBUNTU-CVE-2026-107715

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanizerequestheaders= is reapplied by Mechanize::HTTP::Agentrequestaddheaders even after...

CVE-2026-107715

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanizerequestheaders= is reapplied by Mechanize::HTTP::Agentrequestaddheaders even after...

UBUNTU-CVE-2026-107399

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

Insufficient Session Expiration

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Insufficient Session Expiration via the verifier cache in src/verifier.js, where the cacheSet function only derived exp and nbf bounds from a token's payload when the iat claim was also...

Indico: Missing access check in legacy session export API

Impact A legacy API to retrieve session details could be misused to retrieve metadata such as title, description and conveners of a restricted session within without having access to that session, as long as the event itself was accessible. Patches You should to update to Indico 3.3.13 as soon as...

GHSA-6P4F-J8J6-463Q Indico: Missing access check in legacy session export API

Impact A legacy API to retrieve session details could be misused to retrieve metadata such as title, description and conveners of a restricted session within without having access to that session, as long as the event itself was accessible. Patches You should to update to Indico 3.3.13 as soon as...

Insufficient Session Expiration

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Insufficient Session Expiration in src/verifier.js when the clockTimestamp, clockTolerance, or cacheTTL verifier options are set to non-finite values such as Infinity or NaN. The previous...

CVE-2026-107715 Mechanize sends credential headers to another host after an HTTP redirect

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanizerequestheaders= is reapplied by Mechanize::HTTP::Agentrequestaddheaders even after...

CVE-2026-107715 Mechanize sends credential headers to another host after an HTTP redirect

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanizerequestheaders= is reapplied by Mechanize::HTTP::Agentrequestaddheaders even after...