CVE-2026-120638

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example,...

CVE-2026-120633 CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port

CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, selfurl, virtualhost and virtualport. These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and selfurl are t...

CVE-2026-120633 CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port

CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, selfurl, virtualhost and virtualport. These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and selfurl are t...

CVE-2026-120633

CGI versions before 5.00 for Perl are vulnerable to a flaw where the module trusts the client-provided X-Forwarded-Host header without proper validation. This occurs when the module constructs internal addresses, redirects, or default locations for url, self_url, virtual_host, and virtual_port. A...

CVE-2026-120631 CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse

CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse. CGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires value unescaped into the substitution pattern that...

CVE-2026-115779

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...

CVE-2026-111754

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A...

CVE-2026-63476

A flaw was found in isomorphic-git. A malicious or compromised remote Git server can cause a Denial of Service DoS by sending a specially crafted packfile delta header with an excessively large target size during clone or fetch operations. Because isomorphic-git allocates memory for the target si...

CVE-2026-115779

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...

CVE-2026-115779

The Effect TypeScript framework is vulnerable to cookie attribute injection in the @effect/platform package. Specifically, versions 0.1.0 through 0.97.1 (and effect versions 4.0.0-beta.0 through 4.0.0-beta.103 ) fail to sanitize semicolon delimiters in the name, domain, and path fields passed to ...

CVE-2026-63433

The self-hosted video downloader and player MyTube is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 1.10.6 . The root cause is located in backend/src/middleware/csrfConfig.ts, where the shouldSkipCsrfProtection() function incorrectly grants a CSRF exemption by chec...

CVE-2026-121440

A flaw was found in Wasmtime. When processing HTTP traffic via the WebAssembly System Interface WASI, the runtime fails to validate forwarded HTTP trailers against forbidden header filtering rules. A WebAssembly guest application can exploit this vulnerability by forwarding a request or response...

CVE-2026-121399

A flaw was found in FreeRDP. A malicious Remote Desktop RD Gateway server can trigger a Denial of Service DoS by sending a specially crafted packet header with an excessively large declared length prior to authentication. This causes the client to allocate an excessive amount of system memory,...

CVE-2026-120756

A flaw was found in hdf5. When parsing object header messages, insufficient boundary checks can allow an attacker to trigger a heap buffer over-read by convincing a user or application to open a specially crafted file. Successful exploitation could cause the application to crash, resulting in a...

dpdk: dpdk: heap out-of-bounds read/write in GSO header copy

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...

dpdk: dpdk: heap out-of-bounds read/write in GSO header copy

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...

CVE-2026-102471

A flaw was found in vertx-mail-client. This vulnerability allows an unauthenticated remote attacker to inject arbitrary email headers and manipulate outgoing messages by submitting unsanitized Carriage Return CR and Line Feed LF characters into email fields or attachment metadata. Consequently, a...

USN-8989-1: Rack vulnerabilities

Andrew Lacambra discovered that Rack did not properly parse certain regular expressions. An attacker could possibly use this issue to bypass network security filters. CVE-2026-26961 William T. Nelson discovered that Rack did not handle multipart headers correctly. An attacker could possibly use...

USN-8989-1 ruby-rack vulnerabilities

Andrew Lacambra discovered that Rack did not properly parse certain regular expressions. An attacker could possibly use this issue to bypass network security filters. CVE-2026-26961 William T. Nelson discovered that Rack did not handle multipart headers correctly. An attacker could possibly use...

CVE-2026-113593 Potential exposure of private data via empty and missing Vary headers

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The django.middleware.cache.UpdateCacheMiddleware and the django.views.decorators.cache.cachepage decorator generate identical cache keys for requests that omit a header listed in the response’s Vary...