Typemill CMS < 2.23.0 - Cross-Site Scripting

Typemill CMS before version 2.23.0 is vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify page metadata can inject arbitrary HTML attributes into generated meta tags via the /api/v1/meta endpoint du...

WordPress LearnPress < 4.4.1 - Cross-Site Scripting

LearnPress 4.4.1 does not escape the csearch parameter before reflecting it into the value attribute of the search input on the Course Builder questions page /course-builder/questions/, allowing attribute-injection reflected XSS against authenticated admins/instructors. id: CVE-2026-12970 info:...

CVE-2026-120644

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...

CVE-2026-120644

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...

DEBIAN-CVE-2026-120644

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...

Linux Distros Unpatched Vulnerability : CVE-2026-120644

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values...

CVE-2026-120644

The CGI::Cookie module for Perl (versions before 5.00 ) is vulnerable to cookie attribute injection. The root cause is a failure to validate semicolons or control characters in path , domain , and expires values when writing to the Set-Cookie header. If an application uses untrusted user input to...

CVE-2026-120644 CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...

CVE-2026-120644 CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...

CVE-2026-115779

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...

EUVD-2026-116496

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...

CVE-2026-115779 Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...

CVE-2026-115779

The Effect TypeScript framework is vulnerable to cookie attribute injection in the @effect/platform package. Specifically, versions 0.1.0 through 0.97.1 (and effect versions 4.0.0-beta.0 through 4.0.0-beta.103 ) fail to sanitize semicolon delimiters in the name, domain, and path fields passed to ...

CVE-2026-115779 Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...

CVE-2026-115779: Effect-TS, @effect: Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript…

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...

EUVD-2026-114904

Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute...

openSUSE 16: bouncycastle / bouncycastle-javadoc / bouncycastle-jmail / etc (openSUSE-SU-2026:22169-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22169-1 advisory. Update to 1.86: - CVE-2026-17507: negative signed leafindex values from unsigned wire encodings can cause heap exhaustion bsc1284075. -...

CVE-2026-96631

AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the "X-Forwarded-Prefix" HTTP header. An attacker who can influence this header e.g., through a reverse proxy that forwards it from clients, an attacker-controlled upstream proxy, or a man-in-the-middl...

AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

Summary AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the X-Forwarded-Prefix HTTP header. An attacker who can influence this header e.g., through a reverse proxy that forwards it from clients, an attacker-controlled upstream proxy, or a...

GHSA-79WV-8RH2-9VP2 AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

Summary AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the X-Forwarded-Prefix HTTP header. An attacker who can influence this header e.g., through a reverse proxy that forwards it from clients, an attacker-controlled upstream proxy, or a...