CVE-2026-13832

An use after free flaw was found in the Headless component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513822378...

CVE-2026-59536

Unauthenticated Broken Access Control in CoCart – Headless ecommerce = 4.8.4 versions...

EUVD-2026-49212

Unauthenticated Broken Access Control in CoCart – Headless ecommerce = 4.8.4 versions...

CVE-2026-59536

WordPress CoCart – Headless ecommerce plugin

CVE-2026-59536

Unauthenticated Broken Access Control in CoCart – Headless ecommerce = 4.8.4 versions...

CVE-2026-59536 WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in CoCart – Headless ecommerce = 4.8.4 versions...

CVE-2026-59536 WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in CoCart – Headless ecommerce = 4.8.4 versions...

PT-2026-64931

Unauthenticated Broken Access Control in CoCart – Headless ecommerce = 4.8.4 versions...

CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception in the transfer. An attacker can cause a panic and disrupt DNS service availability by sending an AXFR request to a zone configured with k8sexternal headless-service zone transfers when a headless service endpoint...

AZL-92895 CVE-2026-62994 affecting package coredns for versions less than 1.11.4-20

CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared port...

CVE-2026-62994

CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared port...

CVE-2026-62994 CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared port...

CVE-2026-62994 CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared port...

EUVD-2026-45018

CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared port...

CVE-2026-62994

CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared port...

CVE-2026-62994

CoreDNS vulnerability CVE-2026-62994 affects the Go-based DNS server in versions 1.9.4 through 1.14.5. When a network DNS client uses AXFR for a CoreDNS zone and CoreDNS is configured with the k8s_external headless-service zone transfers feature, and Kubernetes contains a headless service endpoin...

CVE-2026-62994 CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared port...

EUVD-2026-45002

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERMREAD access was sufficient to call fmlistmanagers, fmlistpinsets, fmshowcontext, fmgetmcpconfig, fmbackupstatus, fmwhoscalling, fmrunsavedquery, and fmdiagnosetrunk, exposing AMI manager secrets, outbound dial PIN...

EUVD-2026-45001

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fmdialplanapply accepted template parameters including greeting, dest, url, extension, code, and file, and Tools/DialplanApply.php wrote Dialplan/Templates.php output to extensionscustom.conf while only...