CVE-2026-87858

Temporal Server is vulnerable in its Workflow completion callback delivery logic (both HSM and CHASM implementations). A caller with only write permission in a single namespace can attach a callback with a non-empty source header, causing the History service to re-target the request to the intern...

EUVD-2026-83896

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...

tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.

A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials...

Security Bulletin: IBM Jazz for Service Management is affected by improper neutralization of input and incomplete authorization vulnerabilities in Apache ActiveMQ

Summary IBM Jazz for Service Management is affected by improper neutralization of input and incomplete authorization vulnerabilities in Apache ActiveMQ CVE-2026-42253, CVE-2026-46605 Vulnerability Details CVEID:CVE-2026-42253 DESCRIPTION: Improper Neutralization of Input During Web Page Generatio...

CVE-2025-12999

UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted proxy, falling back to the client-supplied Host header...

CVE-2025-12999

UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted proxy, falling back to the client-supplied Host header...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in Starlette (CVE-2026-54283)

Summary A resource exhaustion Denial of Service vulnerability in the Starlette ASGI framework library CVE-2026-54283 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 1.3.1. Vulnerability Details CVEID:CVE-2025-54121 DESCRIPTION: Starlette is a...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in axios (CVE-2026-44486, CVE-2026-44487)

Summary Multiple proxy credential leakage vulnerabilities in the axios HTTP client library CVE-2026-44486, CVE-2026-44487 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 1.18.0. Vulnerability Details CVEID:CVE-2026-44486 DESCRIPTION: Axios is ...

CVE-2026-90860

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

CVE-2026-63416: Improper Limitation of a Pathname to a Restricted Directory

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo to build a proxyPath and appends it directly to EXPORTURL without rejecting dot segments or confirming that the normalize...

CVE-2026-36470

CuteNews v.2.1.2 is vulnerable to a Cross-Site Scripting (XSS) vulnerability within the index.php file. The root cause is that the application copies the value of the "Referer" header into the response HTML without any modification or escaping during POST messages to index.php. Exploitation detai...

CVE-2026-36470

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php...

CVE-2026-36470: Improper Neutralization of Input During Web Page Generation

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php...

PT-2026-96150

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.2.7 Description The ExportProxyServlet.java component uses request.getPathInfo to construct a proxyPath which is appended to the EXPORT URL. Because the application fails to reject dot segments or verify that the...

CVE-2026-36470

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php...

PT-2026-96127

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description Cross Site Scripting XSS occurs when the application fails to properly sanitize the Referer header during POST requests to the 'index.php' endpoint. This allows the value of the header to be copied into the...

PT-2026-96044

Name of the Vulnerable Software and Affected Versions Canva Mobile App for HarmonyOS versions prior to 1.15.1 Description The application fails to restrict headers returned to an external origin operating within a privileged WebView. A privileged WebView is a system component that allows the...

PT-2026-96279

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.7 Description An issue exists where the 'GET /shares/:id?resource id=' endpoint serves resources with an attacker-controlled mime value and omits the Content-Disposition header when the resource title is...

CVE-2026-94216: Improper Neutralization of CRLF Sequences in HTTP Headers

A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Handler. Executing a manipulation of the argument Success can lead to http response splitting. It is...