CVE-2025-12999

UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted proxy, falling back to the client-supplied Host header...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in Starlette (CVE-2026-54283)

Summary A resource exhaustion Denial of Service vulnerability in the Starlette ASGI framework library CVE-2026-54283 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 1.3.1. Vulnerability Details CVEID:CVE-2025-54121 DESCRIPTION: Starlette is a...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in axios (CVE-2026-44486, CVE-2026-44487)

Summary Multiple proxy credential leakage vulnerabilities in the axios HTTP client library CVE-2026-44486, CVE-2026-44487 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 1.18.0. Vulnerability Details CVEID:CVE-2026-44486 DESCRIPTION: Axios is ...

CVE-2026-90860

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

PT-2026-96149

Name of the Vulnerable Software and Affected Versions Fabio versions 1.6.6 through 1.7.1 Description An issue exists in the way the router handles HTTP headers. In the proxy/http headers.go file, the protectHeaders function uses a hardcoded set of forwarded headers but fails to include...

CVE-2026-73550: Missing Release of Memory after Effective Lifetime

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...

CVE-2026-36470: Improper Neutralization of Input During Web Page Generation

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php...

CVE-2026-63416: Improper Limitation of a Pathname to a Restricted Directory

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo to build a proxyPath and appends it directly to EXPORTURL without rejecting dot segments or confirming that the normalize...

CVE-2026-48826: Improper Privilege Management

HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1ctrlactions.go authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the active group, while the active group i...

CVE-2026-36470

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php...

ALSA-2026:69553 Low: libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...

CVE-2026-36470

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php...

CVE-2026-86473: Insufficient Session Expiration

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

PT-2026-96150

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.2.7 Description The ExportProxyServlet.java component uses request.getPathInfo to construct a proxyPath which is appended to the EXPORT URL. Because the application fails to reject dot segments or verify that the...

PT-2026-96092

Name of the Vulnerable Software and Affected Versions ST Engineering iDirect Evolution versions prior to 20260717 Velocity WebServer Evolution versions prior to 20260717 Description A remote open redirect issue exists within the HTTP Header Handler component. The flaw is located in the authorize...

CVE-2026-36470

CuteNews v.2.1.2 is vulnerable to a Cross-Site Scripting (XSS) vulnerability within the index.php file. The root cause is that the application copies the value of the "Referer" header into the response HTML without any modification or escaping during POST messages to index.php. Exploitation detai...

EUVD-2026-83992

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php...

PT-2026-96279

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.7 Description An issue exists where the 'GET /shares/:id?resource id=' endpoint serves resources with an attacker-controlled mime value and omits the Content-Disposition header when the resource title is...

PT-2026-96127

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description Cross Site Scripting XSS occurs when the application fails to properly sanitize the Referer header during POST requests to the 'index.php' endpoint. This allows the value of the header to be copied into the...