CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the getFilename process. An attacker can inject arbitrary headers into MIME messages by supplying a crafted attachment filename containing carriage return and line feed characters, which are not properly sanitized...

CVE-2026-48205

A flaw was found in the Apache Camel DNS component. An unauthenticated remote attacker could exploit an improper input validation vulnerability by manipulating DNS operation parameters in HTTP message headers. This allows the attacker to perform a Server-Side Request Forgery SSRF attack,...

thunderbird: Thunderbird: Memory safety violations via maliciously crafted mail headers

A flaw was found in Thunderbird where a maliciously constructed mail header could lead to ambiguous parsing. This vulnerability could result in multiple mail header fields being incorrectly interpreted as one, or cause memory safety violations. A remote attacker could potentially exploit this to...

CVE-2026-64958

A flaw was found in Apache CXF. This vulnerability allows a remote attacker to perform a denial of service DoS attack by sending a message with an excessive number of attachment headers. This can lead to the affected system becoming unresponsive or unavailable...

CVE-2026-96445

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

php: php: Credential disclosure via cross-origin HTTP redirects

A flaw was found in PHP. When following a redirect, the built-in HTTP Hypertext Transfer Protocol stream wrapper forwards sensitive request headers—such as authentication tokens and session cookies—unchanged, even when directed to a different host, port, or unencrypted connection. A malicious...

CVE-2026-96445

A flaw exists in the Conditional OTP authenticator of Keycloak , an identity and access management solution. The system improperly evaluates specific HTTP headers to decide whether to skip a one-time password (OTP) without verifying if those headers originate from a trusted source . Consequently,...

CVE-2026-96445 Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2026-96445 Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2026-96445

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2026-87070 Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry...

PT-2026-97286

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Conditional OTP authenticator of Keycloak. The system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped but fails to verify if...

PT-2026-97272

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry...

CVE-2026-96445: Improper Authentication

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

EUVD-2026-83986

Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers clientip/tls/requestid still strippable via the Connection header...

CVE-2026-90990

Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk 2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to infer information about hosts and services...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.15 packages and security update

Red Hat OpenShift Container Platform release 4.22.15 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

[SECURITY] Fedora 45 Update: nv-codec-headers13.0-13.0.19.1-1.fc45

FFmpeg version of headers required to interface with Nvidias codec APIs...

PT-2026-96325

Name of the Vulnerable Software and Affected Versions Dancer2 versions prior to 2.2.0 Description The headers to array function fails to strip Carriage Return CR and Line Feed LF characters from response header names. While the routine removes these characters from header values, names containing...

CVE-2026-93711: Improper Neutralization of CRLF Sequences in HTTP Headers

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...