CVE-2026-87858

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...

EUVD-2026-83896

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...

CVE-2026-87858

Temporal Server is vulnerable in its Workflow completion callback delivery logic (both HSM and CHASM implementations). A caller with only write permission in a single namespace can attach a callback with a non-empty source header, causing the History service to re-target the request to the intern...

CVE-2026-87858 Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...

CVE-2026-87858 Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...

CVE-2026-87858 Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...

tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.

A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials...

Security Bulletin: IBM Jazz for Service Management is affected by improper neutralization of input and incomplete authorization vulnerabilities in Apache ActiveMQ

Summary IBM Jazz for Service Management is affected by improper neutralization of input and incomplete authorization vulnerabilities in Apache ActiveMQ CVE-2026-42253, CVE-2026-46605 Vulnerability Details CVEID:CVE-2026-42253 DESCRIPTION: Improper Neutralization of Input During Web Page Generatio...

CVE-2025-12999

UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted proxy, falling back to the client-supplied Host header...

CVE-2025-12999

UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted proxy, falling back to the client-supplied Host header...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in Starlette (CVE-2026-54283)

Summary A resource exhaustion Denial of Service vulnerability in the Starlette ASGI framework library CVE-2026-54283 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 1.3.1. Vulnerability Details CVEID:CVE-2025-54121 DESCRIPTION: Starlette is a...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in axios (CVE-2026-44486, CVE-2026-44487)

Summary Multiple proxy credential leakage vulnerabilities in the axios HTTP client library CVE-2026-44486, CVE-2026-44487 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 1.18.0. Vulnerability Details CVEID:CVE-2026-44486 DESCRIPTION: Axios is ...

CVE-2026-90860

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

CVE-2026-63416: Improper Limitation of a Pathname to a Restricted Directory

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo to build a proxyPath and appends it directly to EXPORTURL without rejecting dot segments or confirming that the normalize...

CVE-2026-87858: Reliance on Untrusted Inputs in a Security Decision

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...

CVE-2026-36470

CuteNews v.2.1.2 is vulnerable to a Cross-Site Scripting (XSS) vulnerability within the index.php file. The root cause is that the application copies the value of the "Referer" header into the response HTML without any modification or escaping during POST messages to index.php. Exploitation detai...

CVE-2026-36470

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php...

CVE-2026-48826: Improper Privilege Management

HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1ctrlactions.go authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the active group, while the active group i...

PT-2026-96149

Name of the Vulnerable Software and Affected Versions Fabio versions 1.6.6 through 1.7.1 Description An issue exists in the way the router handles HTTP headers. In the proxy/http headers.go file, the protectHeaders function uses a hardcoded set of forwarded headers but fails to include...