CVE-2026-67421

The messaging broker RabbitMQ is vulnerable to a stored HTML injection in the Management UI when the OAuth UI is enabled. Specifically, versions 3.13.0 to 3.13.18 , 4.0.23 , 4.1.14 , 4.2.9 , and 4.3.4 may render an AMQP authorization-error reason as HTML if it contains an attacker-controlled queu...

EUVD-2026-87148

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, settokenauth/2 inserted a bearer token from the Authorization header or accesstoken cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the...

CVE-2026-67421: Missing Authorization

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an...

Linux Distros Unpatched Vulnerability : CVE-2026-67421

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP...

PT-2026-98926

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.18 RabbitMQ versions 4.0.x prior to 4.0.24 RabbitMQ versions 4.1.x prior to 4.1.15 RabbitMQ versions 4.2.x prior to 4.2.10 RabbitMQ versions 4.3.x prior to 4.3.5 Description RabbitMQ Management renders an...

NPM: 9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

NPM: 9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.2...

9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

Summary The Kiro API-key validation endpoint builds an upstream URL using a user-controlled region value. By supplying a crafted region such as kiro-canary.local:8443, an authenticated attacker can cause 9router to send the Kiro validation request to an attacker-controlled host under the...

EUVD-2026-44813

9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding...

GHSA-6MWV-4MRM-5P3M 9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

Summary The Kiro API-key validation endpoint builds an upstream URL using a user-controlled region value. By supplying a crafted region such as kiro-canary.local:8443, an authenticated attacker can cause 9router to send the Kiro validation request to an attacker-controlled host under the...

9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

The Kiro API-key validation endpoint builds an upstream URL using a user-controlled region value. By supplying a crafted region such as kiro-canary.local:8443, an authenticated attacker can cause 9router to send the Kiro validation request to an attacker-controlled host under the constructed...

Authentication Replay

Http4s is vulnerable to an authentication replay. The vulnerability is due to incorrectly storing the last nonce-count value instead of the highest accepted value, which allows an attacker who passively captures a valid Authorization header to replay it multiple times and execute authenticated,...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 ⚠ This tool is created solely for education...

PYSEC-2026-3989

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

PYSEC-2026-3990

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in axios (CVE-2026-44486, CVE-2026-44487)

Summary Multiple proxy credential leakage vulnerabilities in the axios HTTP client library CVE-2026-44486, CVE-2026-44487 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 1.18.0. Vulnerability Details CVEID:CVE-2026-44486 DESCRIPTION: Axios is ...

CVE-2026-86473: Insufficient Session Expiration

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

CVE-2026-85719

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

cve-2026-41940-PoC

CVE-2026-41940 ⚠ Esta herramienta ha sido creada únicamente con fines educativos o de bug bounty. Queda estrictamente prohibido su uso no autorizado fuera de entornos controlados. Descripción Una herramienta para explotar CVE-2026-41940, un bypass de autenticación crítico en cPanel & WHM CVSS 10....

Replay Attack

Overview Affected versions of this package are vulnerable to Replay Attack through improper handling of the DigestAuth process. An attacker can execute authenticated requests as another user by replaying a previously captured Authorization header. Workaround Users that are not able to upgrade to...