CVE-2024-6423

Multiple WSO2 products are affected by CVE-2024-6423 due to a failure to enforce validation constraints on user-supplied URL parameters . While the software does not actively utilize the captured data, it may accept and subsequently record sensitive information in access logs . This oversight cou...

CVE-2024-6423 Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends...

EUVD-2024-55814

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends...

CLSA-2026-1776878817 squid: Fix of 13 CVEs

CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection - CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages - CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from...

squid: Fix of 13 CVEs

CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection - CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages - CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from...

CVE-2024-4989 Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

EUVD-2024-55811

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

CVE-2024-4989

The WSO2 API Manager is vulnerable to an open redirection flaw due to the callback URL parameter failing to validate user-supplied input. Malicious actors can control this parameter to redirect users to arbitrary web pages. This vulnerability can be leveraged in social engineering schemes to perf...

CVE-2026-61916

Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit se...

EUVD-2026-107177

Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit se...

CVE-2026-61916 Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms

Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit se...

CVE-2026-61916

Apache bRPC versions before 1.18.0 are vulnerable to an out-of-bounds read in URL parsing and case-insensitive header lookups on platforms where plain char is unsigned (e.g., ARM64 ). The root cause is the failure to normalize input bytes to a signed-char range before accessing biased 256-entry l...

CVE-2026-85683

The Jane Menu WordPress plugin, in versions prior to 1.5.1 , is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) . The root cause is a lack of capability or nonce checks on a form handler accessible by unauthenticated users, which allows them to bind any published page to a remote ...

CVE-2026-85683 Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL

The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its...

CVE-2026-85683 Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL

The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its...

CVE-2026-101138 CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active...

CVE-2026-101138

The CMP – Coming Soon & Maintenance WordPress plugin, in versions 4.1.19 through 4.1.20 , is vulnerable to an unauthenticated maintenance mode bypass. The flaw occurs because the plugin fails to correctly apply maintenance mode restrictions to pages included in a whitelist via manually entered UR...

CVE-2026-101138 CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active...

CVE-2026-17557

A flaw was found in the lm-evaluation-harness component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the JobSpec. This vulnerability allows for the disclosure of the tenant's model authentication secret ...

EUVD-2026-107088

The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes ...