EUVD-2026-48242

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

CVE-2026-65606 SiYuan before v3.7.2 Cross-Site Scripting to RCE

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

PYSEC-2026-3484 meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token Summary AuthInjectionMiddleware in meta-ads-mcp rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent. Because extracttokenfromheaders does not recognise the X-Pipeboard-Token header, an attacker who sends...

PYSEC-2026-3472 jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used

A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the alloworiginpat configuration is used. The issue arises from the use of re.match for validating the Origin header, which only anchors at the start of the string. This allow...

EUVD-2026-47906

The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asmcode' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15394 Header Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta

The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asmcode' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-64875

The CVE-2026-64875 entry concerns a Joomla GeoIP extension by regularlabs.com. The issue is an IP spoofing vulnerability where GeoIP lookups trust spoofable forwarded client-IP headers, enabling potential GeoIP-rule bypass. Affected component: GeoIP extension within the Regular Labs Joomla extens...

SUSE CVE-2026-55602

http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request...

PT-2026-64186

Name of the Vulnerable Software and Affected Versions 9router versions prior to 0.4.60 Description An issue exists involving a chain of security flaws. A hardcoded default password allows authentication on fresh installations. Additionally, the LOCAL ONLY network gate can be bypassed using a...

PT-2026-64102

Summary When Pillow loads an uncompressed image whose tile uses the raw codec and a mode in Image. MAPMODES, and the image was opened from a filename, it memory-maps the file and builds the image's row pointers directly into the mapping via PyImaging MapBuffer src/map.c. The per-row spacing strid...

PT-2026-64153

Name of the Vulnerable Software and Affected Versions swift-nio-http2 versions prior to 1.45.0 Description SwiftNIO HTTP/2 lacks validation for inbound HEADERS frames, allowing control characters such as CR, LF, NUL, and SP to reach an HTTP/1.1 backend via the HTTP/2-to-HTTP/1 codec. This can lea...

PT-2026-64146

Name of the Vulnerable Software and Affected Versions aws-smithy-http-server versions prior to 0.66.5 Description An issue in the default serve path of Amazon aws-smithy-http-server allows unauthenticated Slowloris denial of service. This occurs due to missing connection and header-read timeouts...

Next.js: Server-Side Request Forgery in Server Actions on custom servers

Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forgery. This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtai...

GHSA-89XV-2M56-2M9X Next.js: Server-Side Request Forgery in Server Actions on custom servers

Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forgery. This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtai...

EUVD-2026-43646

Eclipse Jetty: HTTP Authority/Host mismatch...

Eclipse Jetty: HTTP Authority/Host mismatch

Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty: - logic based on HttpURI / Request.getServerNamerequest uses :authority -...

GHSA-7P3P-8QV8-M2VH Eclipse Jetty: HTTP Authority/Host mismatch

Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty: - logic based on HttpURI / Request.getServerNamerequest uses :authority -...

Improper Validation of Consistency within Input

Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Improper Validation of Consistency within Input through ComplianceUtils.verifyHttpURI, HttpFields, HttpCompliance,...

GHSA-8HG6-C449-896M Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

Summary dompdf accepts a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor$width,...

GHSA-GCJF-9MGH-3P7G Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-http multipart | | Component |...