EUVD-2026-75430

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructur...

CVE-2026-88880 Renovate before 44.11.3 Credential Exfiltration via Link Header

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructur...

CVE-2026-88879

Traefik (HTTP reverse proxy and load balancer) is vulnerable to identity spoofing via dot-form header aliasing in versions v1.x, v2.x–v2.11.55, and v3.0.0–v3.7.11. Because Go canonicalizes header names on dashes only, a client can send a dot-form alias (e.g., X.Authenticated.User) alongside the c...

CVE-2026-88879 Traefik before v2.11.56 Identity Spoofing via Header Alias

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, XAuthUser and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable...

CVE-2026-88879

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, XAuthUser and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable...

EUVD-2026-75429

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, XAuthUser and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable...

CVE-2026-88879 Traefik before v2.11.56 Identity Spoofing via Header Alias

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, XAuthUser and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable...

CVE-2026-88879 Traefik before v2.11.56 Identity Spoofing via Header Alias

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, XAuthUser and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable...

EUVD-2026-75427

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

CVE-2026-88877

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

CVE-2026-88866

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1 ) contains a stored cross-site scripting vulnerability in the LoginControl plugin . The plugin fails to encode the User-Agent header before storing it in the login history. An attacker with any valid login account can inject mal...

EUVD-2026-75416

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in...

CVE-2026-88866 WWBN AVideo LoginControl Stored XSS via User-Agent Header

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in...

EUVD-2026-75412

Capgo capgo.app backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg in supabase/functions/backend/utils/honomiddleware.ts resolves the attacker-supplied numeric API key ID using only the key ID, its expiration state, and t...

openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova

A flaw in OpenStack Nova’s interaction with the qemu-img utility allows an authenticated user to overwrite arbitrary files on the compute host. This occurs because Nova invokes qemu-img without strictly constraining the disk image format, enabling a malicious user to craft a QCOW2 header on a raw...

EUVD-2026-75398

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

EUVD-2026-75387

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or...

CVE-2026-87961 ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the readID3Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size...

Security Bulletin: Multiple vulnerabilities affects IBM Db2 Big SQL on IBM Software Hub

Summary Multiple vulnerabilities affects IBM Db2 Big SQL on IBM Software Hub 5.4 and earlier. Vulnerability Details CVEID:CVE-2026-53655 DESCRIPTION: node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar node-tar applies a PAX extended header's size= record and other PAX overrides to...

PYSEC-2026-3848 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

Summary HTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...