EUVD-2026-107012

SvelteKit : XSS via untrusted cache-control header in prerendered page...

SvelteKit : XSS via untrusted cache-control header in prerendered page

Impact Applications that prerender pages and use setHeaders to set a cache-control header from an untrusted source are vulnerable to cross-site scripting XSS. SvelteKit inserts the header value into a tag without escaping it. An attacker who can influence this value at prerender time can break ou...

CVE-2025-69581

CVE-2025-69581 An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personaldata endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all personal data, allowing unauthorized users on the...

Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27mw-82g8-phjj. This link is maintained to preserve external references. Original Description SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a...

CVE-2026-114061

SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the conten...

CVE-2026-114061 SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the conten...

CVE-2026-114061 SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the conten...

CVE-2026-114061

SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the conten...

CVE-2026-114061

SvelteKit (@sveltejs/kit ) versions before 3.0.0 are vulnerable to a cross-site scripting (XSS) flaw in prerendered pages. The root cause is the lack of proper escaping when a cache-control header value, set via setHeaders, is inserted into a tag. If an attacker can influence this untrusted valu...

PT-2026-120187

Name of the Vulnerable Software and Affected Versions SvelteKit @sveltejs/kit versions prior to 3.0.0 Description Prerendered pages are subject to cross-site scripting XSS because a cache-control header value defined via the setHeaders function is inserted into a tag without proper escaping. An...

CVE-2026-76151

A flaw was found in the QtNetwork module of the Qt Framework. This out-of-bounds read vulnerability allows a remote attacker to cause a denial of service application crash. This occurs when an application using QNetworkAccessManager processes an excessively large HTTP Cache-Control header value...

UBUNTU-CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

The symfony/http-foundation component is vulnerable to a Regular Expression Denial of Service (ReDoS) in the HeaderUtils::split() function. The root cause is a regex pattern that matches whitespace followed by a lookbehind; an attacker can provide a long sequence of whitespace in the Cache-Contro...

CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

EUVD-2026-102102

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082: Inefficient Regular Expression Complexity

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

PT-2026-114951

Name of the Vulnerable Software and Affected Versions symfony/http-foundation versions 4.1.0-BETA1 through 5.4.53 symfony/http-foundation versions 6.0.0-BETA1 through 6.4.45 symfony/http-foundation versions 7.0.0-BETA1 through 7.4.18 symfony/http-foundation versions 8.0.0-BETA1 through 8.1.6...