CVE-2026-72702

Grav CMS versions before 2.0.16 contain an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods. The root cause is an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter, meaning an attacker who controls a domain that begins ...

CVE-2026-72702 Grav CMS before 2.0.16 Origin Validation Bypass via Referer

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods, which validate the Referer header using an unanchored string prefix match strstartswith$referrer, $base with no trailing delimiter. An attacker who controls a domain that begins with...

CVE-2026-56709

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the requiretrustedhost...

EUVD-2026-65207

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the requiretrustedhost...

CVE-2026-56709 Grav before 3.9.2 Host Header Injection via sendInvitationEmail

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the requiretrustedhost...

CVE-2026-56709 Grav before 3.9.2 Host Header Injection via sendInvitationEmail

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the requiretrustedhost...

CVE-2026-56709

Grav before 3.9.2 is vulnerable to a Host header injection in the sendInvitationEmail() function. When constructing token-bearing invitation links, the unvalidated Host header allows an attacker to poison the link and redirect users to an attacker-controlled domain . This bypasses the require_tru...

CVE-2026-34959 Adminer before 5.5.0 Open Redirect via X-Forwarded-Prefix

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...

EUVD-2026-65196

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...

CVE-2026-34959

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] without a trusted-proxy check or validation of the prefix value. An attacker can inject an absolute URL (e.g., https://evil.example) that propagates into Location redirect headers, the Set...

CVE-2026-16434 Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass

Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...

CVE-2026-34959

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...

CVE-2026-34959

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...

SUSE CVE-2026-74684

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

The vulnerability in the module drivers/net/ethernet/intel/igc/igc_defines.h of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the drivers/net/ethernet/intel/igc/igcdefines.h module of the Linux operating system is related to peculiarities in interactions with the hardware. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-77680: Inefficient Algorithmic Complexity

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in...

CVE-2026-56709: Reliance on Reverse DNS Resolution for a Security-Critical Action

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the requiretrustedhost...

CVE-2026-72702: Origin Validation Error

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods, which validate the Referer header using an unanchored string prefix match strstartswith$referrer, $base with no trailing delimiter. An attacker who controls a domain that begins with...

CVE-2026-77680: Inefficient Algorithmic Complexity

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in...

RHCOS 4 : OpenShift Container Platform 4.21.30 (RHSA-2026:57456)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57456 advisory. - mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-42504 Note that Nessus has not tested for this...