CVE-2026-121491

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race...

CVE-2026-121491

The Fiber Admin WordPress plugin (versions 3.1.0-4.0.0 ) is vulnerable to Remote Code Execution (RCE) due to a failure to validate or escape a request header before writing it into a regenerated PHP file. This occurs on an unprotected admin hook. An unauthenticated attacker can achieve execution ...

CVE-2026-121491 Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host Header

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race...

EUVD-2026-118943

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race...

docker_CVE-2014-6271.

dockerCVE-2014-6271. 1. docker build -t DOCKERIMAGENAME /path/to/dockerfiledirectory 2. docker run -it -d -p 8080:80 DOCKERIMAGENAME 3. verify execution with: docker ps 4. verify web server execution: http://localhost:8080 5. exploit vulnerability : curl -H "user-agent: :; ; echo; echo; /bin/bash...

CLEANSTART-2026-EP54530 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

Security vulnerability affects the trino package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...

Linux Distros Unpatched Vulnerability : CVE-2026-120415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect interceptor strips sensitive headers such as...

EulerOS Virtualization 2.15.1 : perl-HTTP-Tiny (EulerOS-SA-2026-4659)

According to the versions of the perl-HTTP-Tiny package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.The...

EulerOS Virtualization 2.15.0 : python-pip (EulerOS-SA-2026-4846)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to t...

CVE-2026-63439

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIONGUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user reads the default REMOTEUSER identity header, or a custom identity header selected by the...

CVE-2026-63439

The 2FAuth web application is vulnerable to authentication bypass in versions prior to 8.0.0 . When the AUTHENTICATION_GUARD=reverse-proxy-guard setting is enabled, the ReverseProxyGuard::user() function fails to verify that the request originated from a trusted proxy. This allows a remote client...

CVE-2026-63439 2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIONGUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user reads the default REMOTEUSER identity header, or a custom identity header selected by the...

EUVD-2026-118492

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIONGUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user reads the default REMOTEUSER identity header, or a custom identity header selected by the...

CVE-2026-63439 2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIONGUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user reads the default REMOTEUSER identity header, or a custom identity header selected by the...

CVE-2026-63439 2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIONGUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user reads the default REMOTEUSER identity header, or a custom identity header selected by the...

CVE-2025-55182

CVE-2025-55182 / CVE-2025-66478 — Next.js Middleware / RSC Bypass Analysis The author assumes no liability for misuse or damage caused by this research Provided strictly for educational and defensive purposes Description This repository contains a small laboratory and Proof-of-Concept analysis fo...

CVE-2026-55458

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion...

CVE-2026-66981

HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended...

io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite

A flaw was found in Netty, an asynchronous, event-driven network application framework. The CorsHandler component incorrectly replaces application Vary headers, such as Authorization or Cookie, with Origin. This allows a caching proxy or Content Delivery Network CDN to reuse authenticated respons...

CVE-2026-66981 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended...