CVE-2026-102878 mcp-chrome-bridge through 1.0.31 CORS Origin Bypass

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

CVE-2026-73257

A flaw was found in Mongoose. When processing incoming requests containing both Content-Length and Transfer-Encoding headers, the server accepts both headers instead of rejecting the malformed request. In environments where an upstream proxy processes request boundaries differently, a remote,...

EUVD-2026-71661

undici vulnerable to downstream response splitting via retry interceptor...

Uncontrolled Resource Consumption

Apache Struts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unrestricted reading of Content Security Policy violation reports into memory, which allows an unauthenticated attacker to submit an oversized report and exhaust the application's heap, causing a...

EUVD-2026-71634

undici vulnerable to Denial of Service via unbounded decompression of compressed responses...

undici vulnerable to Denial of Service via unbounded decompression of compressed responses

Impact The interceptors.decompress interceptor decompresses HTTP response bodies according to the untrusted Content-Encoding header. The number of decompression layers is capped at 5, but the total decompressed output size is not bounded and there is no option to limit it. A malicious or faulty...

CVE-2026-102811

Marmite through 0.4.2 contains missing authentication in the development server endpoints /marmite/content, /marmite/config, and /marmite/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in...

CVE-2026-102811 Marmite through 0.4.2 Unauthenticated API Access via Development Server

Marmite through 0.4.2 contains missing authentication in the development server endpoints /marmite/content, /marmite/config, and /marmite/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in...

CVE-2026-102811

Marmite versions through 0.4.2 are vulnerable to unauthenticated API access via its development server endpoints: /__marmite__/content, /__marmite__/config, and /__marmite__/file/. Due to missing authentication, attackers can create, modify, or overwrite site content and configurations. Furthermo...

EUVD-2026-89111

Marmite through 0.4.2 contains missing authentication in the development server endpoints /marmite/content, /marmite/config, and /marmite/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in...

CVE-2026-102811 Marmite through 0.4.2 Unauthenticated API Access via Development Server

Marmite through 0.4.2 contains missing authentication in the development server endpoints /marmite/content, /marmite/config, and /marmite/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in...

CVE-2026-102811 Marmite through 0.4.2 Unauthenticated API Access via Development Server

Marmite through 0.4.2 contains missing authentication in the development server endpoints /marmite/content, /marmite/config, and /marmite/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in...

CVE-2026-90916

Joomla! Core - 20260906 - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents...

CVE-2026-90917

Joomla! Core - 20260907 - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view content items from inaccessible categories...

CVE-2026-90916

Joomla! Core - 20260906 - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents...

CVE-2026-90917

The Joomla! Core component is vulnerable to an improper access check in the outputs for tagged items. This flaw allows unauthorized users to view content items that are located within inaccessible categories across Joomla versions 4.0.0-5.4.8 and 6.0.0-6.1.3 . No specific exploit details or remed...

CVE-2026-90917 Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260907 - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view content items from inaccessible categories...

EUVD-2026-89072

Joomla! Core - 20260906 - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents...

CVE-2026-90916 Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260906 - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents...

CVE-2026-90916

The Joomla! Core software is affected by an improper access check within the content history comparison view. This vulnerability allows unauthorized users to view contents they should not have access to. The affected versions include Joomla 4.0.0-5.4.8 and 6.0.0-6.1.3 . No specific exploitation d...