36775 matches found
PT-2026-75517
TuxCare rebuilt tough-cookie to address 2 CVEs. Fixed in 2.2.2-tuxcare.2...
PT-2026-74026
TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.0.5-tuxcare.1...
PT-2026-74054
TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.4.2-tuxcare.1...
PT-2026-74927
TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.4.0-tuxcare.1...
PT-2026-73947
TuxCare rebuilt tough-cookie to address 1 CVE. Fixed in 2.4.3-tuxcare.1...
PT-2026-67848
Name of the Vulnerable Software and Affected Versions MaxSite CMS affected versions not specified Description An issue exists where unauthenticated attackers can execute arbitrary code by providing malicious serialized data through the maxsite comuser cookie. The application passes this data...
CVE-2026-70554: Deserialization of Untrusted Data
MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...
Linux Distros Unpatched Vulnerability : CVE-2026-69245
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless...
PT-2026-73948
TuxCare rebuilt tough-cookie to address 1 CVE. Fixed in 3.0.1-tuxcare.1...
PT-2026-67647
The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood...
SUSE CVE-2026-16729
undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can...
DEBIAN-CVE-2026-69245
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...
CVE-2026-69245
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...
UBUNTU-CVE-2026-69245
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...
CVE-2026-69245
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...
Guzzle: Noncanonical host can bypass host-based checks
Impact In affected versions, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same through fopen. libcurl then parses the...
GHSA-V5MV-P594-2X33 Guzzle: Noncanonical host can bypass host-based checks
Impact In affected versions, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same through fopen. libcurl then parses the...
Guzzle: Noncanonical cookie domain keeps subdomain scope
Impact SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless it recognizes the Domain as an IP literal or a numeric host, and it decides that from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. On 7.15, hexadecimal and...
GHSA-F7VP-7XGX-4W4R Guzzle: Noncanonical cookie domain keeps subdomain scope
Impact SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless it recognizes the Domain as an IP literal or a numeric host, and it decides that from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. On 7.15, hexadecimal and...
CVE-2026-69245
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...