DEBIAN-CVE-2026-59941

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...

CVE-2026-49447

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...

UBUNTU-CVE-2026-59941

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...

CVE-2026-59941

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...

GHSA-2RX5-2G7J-2659 Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

Summary The Constellation-tunnel bypass branch in tokenMiddleware at src/proxy/routerGen.go:53-66 returns to the upstream handler before the request's x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers are stripped at lines 68-72, and before the AdminOnlyWithRedirect gate ...

Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

Summary The Constellation-tunnel bypass branch in tokenMiddleware at src/proxy/routerGen.go:53-66 returns to the upstream handler before the request's x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers are stripped at lines 68-72, and before the AdminOnlyWithRedirect gate ...

CVE-2026-59941 Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...

CVE-2026-59941

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...

CVE-2026-59941

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...

EUVD-2026-50056

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...

CVE-2026-49447

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...

CVE-2026-49447

Cosmos-Server 0.22.18 reportedly exposes constellation device metadata via GET /cosmos/api/constellation/public-devices when any non-empty Authorization header is provided; the code strips Bearer but does not validate or use the token in the DB query, allowing unauthenticated-like access to devic...

CVE-2026-49447 Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...

CVE-2026-49447 Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...

Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Summary GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This...

CVE-2026-57511

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SM...

cowlib: Cowlib: Denial of Service due to unbounded HPACK/QPACK prefixed-integer decoding

A flaw was found in cowlib, an HTTP parser. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 frames containing oversized HPACK or QPACK prefixed integers. This unbounded decoding process leads to excessive memory allocation and...

cowlib: Cowlib: Denial of Service due to unbounded HPACK/QPACK prefixed-integer decoding

A flaw was found in cowlib, an HTTP parser. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 frames containing oversized HPACK or QPACK prefixed integers. This unbounded decoding process leads to excessive memory allocation and...

CVE-2026-57511 SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SM...

CVE-2026-57511 SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SM...