32407 matches found
CVE-2026-84933 undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...
CVE-2026-84933 undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...
CVE-2026-84933
undici , the Node.js HTTP client library, has a flaw in its cache interceptor that fails to handle the Set-Cookie response header in its cache path—neither refusing to store nor stripping it. In shared cache mode (the default), a cacheable response carrying a Set-Cookie header is stored and re-se...
CVE-2026-84933
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...
CVE-2026-75171
An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component...
CVE-2026-82186
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...
CVE-2026-82186
The WPLP Cookie Consent WordPress plugin (full name: WP Cookie Notice for GDPR, CCPA & ePrivacy Consent) in versions before 4.4.2 fails to properly validate the offset pagination parameter before using it in a SQL query, enabling users with administrator privileges to perform SQL injection . The ...
CVE-2026-82186 WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...
WordPress WPLP Cookie Consent plugin < 4.4.2 - Admin+ SQLi vulnerability
Admin+ SQLi vulnerability discovered by cyberkareem in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...
EUVD-2026-70909
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...
CVE-2026-75171
An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component...
EUVD-2026-71442
An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component...
CVE-2026-75171
CVE-2026-75171 is a critical (CVSS 9.8) privilege escalation vulnerability in HubCore v.14.1.1 , exploitable by a remote, unauthenticated attacker via the HUBCOREID session cookie handling component. The CISA SSVC assessment rates exploitation as none observed, the vulnerability as automatable , ...
EUVD-2022-56032
In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...
PT-2026-86152
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...
Linux Distros Unpatched Vulnerability : CVE-2026-80890
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: reject stale cookies with mismatched verification tags sctpunpackcookie skips cookie expiration checks whenever an association already exists. This is...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cockpit (UTSA-2026-106156)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106156 advisory. A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowi...
Linux Distros Unpatched Vulnerability : CVE-2026-84933
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In...
GHSA-8CJ9-R88M-8945 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
Summary The password change form is vulnerable to CSRF, allowing an attacker to change a user password even the administrator by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20. Details The password change endpoint of Semaphore UI doe...