BIT-TOMCAT-2025-66614 Apache Tomcat: Client certificate verification bypass due to virtual host mapping

Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0 through 11.0.14, from 10.1.0 through 10.1.49, from 9.0.0 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions...

Moderate: Red Hat Security Advisory: gstreamer1-plugins-base security update

An update for gstreamer1-plugins-base is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-81754

The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-18579

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPXFORWARDEDFOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

EUVD-2026-75935

The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-81754 Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting

The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-81754 Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting

The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-81754

The Vigilant WordPress security plugin is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the User-Agent header in all versions up to and including 2.10.2 . The root cause is insufficient input sanitization and output escaping during failed login attempts. An unauthenticated v...

CVE-2026-18579 WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPXFORWARDEDFOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

EUVD-2026-75953

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPXFORWARDEDFOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-18579

WP Photo Album Plus (WordPress plugin) versions up to and including 9.2.08.003 are vulnerable to unauthenticated Stored XSS via the HTTP_X_FORWARDED_FOR parameter. The root cause is insufficient input sanitization and output escaping: a deliberately failed nonce check on the getshortcodedrendered...

EUVD-2026-75877

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header...

PT-2026-90522

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A file-upload handler redirects the authenticated client's browser to a URL sourced directly from the Referer header of the request without validating it agains...

CVE-2026-90453: URL Redirection to Untrusted Site

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...

PT-2026-90053

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

CVE-2026-90447: Authentication Bypass by Spoofing

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-81754: Improper Neutralization of Input During Web Page Generation

The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-89239: Improper Neutralization of Input During Web Page Generation

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage function that inserts the raw Referer header into a JavaScript comment without encoding. Attackers can craft a Referer header containing / to close t...

PT-2026-89869

Name of the Vulnerable Software and Affected Versions Headroom versions prior to 0.35.0 Description The Headroom WebSocket server fails to validate the Origin header of incoming client WebSocket requests before forwarding them to the upstream server. This allows malicious WebSocket clients, which...

CVE-2026-71416: Improper Authentication

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to...