CVE-2026-73359: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.3.9 versions...

PT-2026-77311

Name of the Vulnerable Software and Affected Versions fastify versions 5.8.3 through 5.12.0 Description An issue exists in the handling of forwarded-header reads used to derive request host, protocol, hostname, ip, and ips values. When the trustProxy setting is configured with a numeric hop-count...

SUSE CVE-2026-48551

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

CVE-2026-55674

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted colorschemeid or darkschemeid cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered...

CVE-2026-55674 Discourse: Cache poisoning/XSS via color scheme cookies

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted colorschemeid or darkschemeid cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered...

CVE-2026-55674

Discourse versions before 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 render the unescaped color_scheme_id/dark_scheme_id cookie value into a color scheme tag, allowing an unauthenticated attacker to break out of the attribute, bypass Discourse's nonce-based CSP, and execute arbitrary JavaScript i...

CVE-2026-55674

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted colorschemeid or darkschemeid cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered...

CVE-2026-55674 Discourse: Cache poisoning/XSS via color scheme cookies

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted colorschemeid or darkschemeid cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered...

CVE-2026-74867

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

EUVD-2026-60086

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

CVE-2026-74867

SiYuan versions before 3.7.4 are affected by a cross-site request forgery (CSRF) vulnerability in the session-cookie authentication branch of CheckAuth() . The root cause is the absence of Origin/Referer header validation combined with the lack of an explicit SameSite attribute on session cookies...

CVE-2026-74867 SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

CVE-2026-74867 SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

CVE-2026-74867

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

WordPress Cookie Banner for GDPR / CCPA plugin <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability discovered by Naoya Takahashi nakko in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.5...

CVE-2026-19974

A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/tsessioncookiestore.cpp of the component Session Cookie Handler. The manipulation results in improper authentication. The attack can be...

CVE-2026-19974

The CVE targets treefrog-framework (treefrog-framework) up to version 2.11.2. The vulnerability lies in the Session Cookie Handler’s tsessioncookiestore.cpp, specifically the use of std::strncmp, enabling improper authentication. It can be exploited remotely with high attack complexity; a public ...

CVE-2026-19974 treefrogframework treefrog-framework Session Cookie tsessioncookiestore.cpp strncmp improper authentication

A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/tsessioncookiestore.cpp of the component Session Cookie Handler. The manipulation results in improper authentication. The attack can be...

CVE-2026-19974

A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/tsessioncookiestore.cpp of the component Session Cookie Handler. The manipulation results in improper authentication. The attack can be...

EUVD-2026-60026

A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/tsessioncookiestore.cpp of the component Session Cookie Handler. The manipulation results in improper authentication. The attack can be...