EUVD-2026-52696

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to...

CVE-2026-67200

CVE-2026-67200 refers to a path traversal in Perspective 5.0.0, exploitable by unauthenticated remote attackers who include literal ../ in HTTP request paths to read arbitrary server files via the cwd_static_file_handler. The vulnerability bypasses insufficient query-string-stripping sanitization...

Security Bulletin:Cross-Origin Redirect Headers Vulnerability in urllib3 Prior to 2.7.0

Summary urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connectionfromurl.urlopen..., assertsamehost=False still forward these sensitive headers. This vulnerability is fixed in 2.7.0. Vulnerability...

urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers

A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...

Security update for perl-HTTP-Tiny (important)

openSUSE Security Update: Security update for perl-HTTP-Tiny Announcement ID: openSUSE-SU-2026:0274-1 Rating: important References: 1271020 Cross-References: CVE-2026-7017 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This...

ALSA-2026:49927 Moderate: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: urllib3: urllib3: Information disclosure via cross-origin redirects...

Moderate: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: urllib3: urllib3: Information disclosure via cross-origin redirects...

RHEL 8 : fence-agents (RHSA-2026:49927)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:49927 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable...

Regular Expression Denial of Service (ReDoS)

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the cors middleware during the parsing of the Access-Control-Request-Headers header via a regular expression with quadratic runtime complexit...

GHSA-8J4G-W8FX-2239 Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

Summary The built-in CORS middleware hono/cors parses the attacker-controlled Access-Control-Request-Headers request header during a preflight OPTIONS request using a regular expression whose running time is quadratic in the input length. A single request carrying a long run of whitespace can...

NPM: Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

NPM: Hono: ReDoS in CORS middleware via Access-Control-Request-Headers vulnerability discovered by ? in WordPress Npm hono versions 4.12.34...

Exposure Of Sensitive Information To An Unauthorized Actor

linuxfabrik-lib is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability is due to lib.url.fetch following cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, which allows an attacker controlling a...

EUVD-2026-39831

nx graph dev server permissive CORS policy...

Sensitive Information Exposure

datamodel-code-generator is vulnerable to Sensitive Information Exposure. The vulnerability is due to the reuse of Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, which allows an attacker controlling a redirect target to...

CVE-2026-65310

ANDRITZ HIPASE-250 formerly 250 SCALA, in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server...

CVE-2026-65310

ANDRITZ HIPASE-250 formerly 250 SCALA, in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server...

EUVD-2026-51500

ANDRITZ HIPASE-250 formerly 250 SCALA, in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server...

CVE-2026-65310

CVE-2026-65310 affects ANDRITZ HIPASE-250 (formerly 250 SCALA). In default configurations, the product exposes its data and configuration endpoint without authentication and with permissive CORS on every response. An unauthenticated attacker with network access can read live process values and se...

CVE-2026-65310 Missing authentication and permissive CORS policy

ANDRITZ HIPASE-250 formerly 250 SCALA, in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server...

SUSE CVE-2026-17662

Insufficient policy enforcement in Prefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...