PT-2026-6338

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email foldin...

Ofisimo Flora 跨站脚本漏洞

Ofisimo Flora is a website-building script developed by the Turkish company Ofisimo. The Ofisimo Flora v3.0 version until 03022026 contained a cross-site scripting vulnerability. This vulnerability stemmed from improper input during web page generation, which could allow for cross-site scripting...

Qwik 跨站请求伪造漏洞

Qwik is a micro-web framework developed by Qwik Dev. Versions of Qwik prior to 1.12.0 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from spelling errors in regular expressions, resulting in incorrect parsing of certain Content-Type headers...

Qwik 跨站请求伪造漏洞

Qwik is a micro-web framework developed by Qwik Dev. Versions of Qwik prior to 1.19.0 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from inconsistent interpretation of HTTP request headers by the server-side request processing logic, allowing remote attackers t...

PT-2026-6472

Summary Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. Impact A vulnerability in checkCSRF lets an attacke...

PT-2026-5880

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.1 Django versions 5.2 through 5.2.10 Django versions 4.2 through 4.2.27 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier Description The ASGIRequest component...

Linux Distros Unpatched Vulnerability : CVE-2026-0865

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - User-controlled header names and values containing newlines can allow injecting HTTP headers. CVE-2026-0865 Note that Nessus relies on the presence of the packa...

Cross-site Request Forgery (CSRF)

Overview omni-cortex is a Give Claude Code a perfect memory - auto-logs everything, searches smartly, and gets smarter over time Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF. The CORS configuration allows wildcard HTTP methods and headers, leading to malicio...

Insufficiently Protected Credentials

Overview kimai-mcp is a MCP server for Kimai time-tracking API integration Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the HTTP response handling logic that sets the X-Session-ID header. An attacker can hijack user sessions by observing session...

EUVD-2020-30926

Crystal Shard http-protection 0.2.0 contains an IP spoofing vulnerability that allows attackers to bypass protection middleware by manipulating request headers. Attackers can hardcode consistent IP values across X-Forwarded-For, X-Client-IP, and X-Real-IP headers to circumvent security checks and...

CVE-2025-7713

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Global Interactive Design Media Software Inc. Content Management System CMS allows XSS Through HTTP Headers.This issue affects Content Management System CMS: through 21072025...

FreeBSD : zeek -- potential DoS vulnerability (8173e68a-88f3-4862-882c-6e58779d98e7)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 8173e68a-88f3-4862-882c-6e58779d98e7 advisory. Tim Wojtulewicz of Corelight reports: Zeek's HTTP analyzer can be tricked into interpreting...

📄 libarchive RAR Double Free / Use-After-Free

This proof of concept demonstrates a memory management flaw in libarchive versions prior to 3.8.0 when handling malformed RAR headers. By supplying a corrupted RAR structure, the code forces error paths during archive parsing, leading to improper cleanup. As a result, the archive object may be...

SUSE-SU-2026:20176-1 Security update for elemental-register, elemental-toolkit

This update for elemental-register, elemental-toolkit fixes the following issues: elemental-register was updated to 1.8.1: Changes on top of v1.8.1: Update headers to 2026 Update questions to include SL Micro 6.2 Update to v1.8.1: Install yip config files in before-install step Bump...

CVE-2025-7713

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Global Interactive Design Media Software Inc. Content Management System CMS allows XSS Through HTTP Headers.This issue affects Content Management System CMS: through 21072025...

CVE-2025-7713

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Global Interactive Design Media Software Inc. Content Management System CMS allows XSS Through HTTP Headers. This issue affects Content Management System CMS: through 21072025...

EUVD-2025-206545

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Global Interactive Design Media Software Inc. Content Management System CMS allows XSS Through HTTP Headers.This issue affects Content Management System CMS: through 21072025...

CVE-2025-7713 Reflected XSS in Global Medya's PHP CMS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Global Interactive Design Media Software Inc. Content Management System CMS allows XSS Through HTTP Headers. This issue affects Content Management System CMS: through 21072025...

CVE-2025-7713 Reflected XSS in Global Medya's PHP CMS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Global Interactive Design Media Software Inc. Content Management System CMS allows XSS Through HTTP Headers. This issue affects Content Management System CMS: through 21072025...

CVE-2025-7713

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Global Interactive Design Media Software Inc. Content Management System CMS allows XSS Through HTTP Headers. This issue affects Content Management System CMS: through 21072025...