PT-2026-99722

Name of the Vulnerable Software and Affected Versions Flatpak affected versions not specified Description A malicious extension can probe the host filesystem to determine the existence of files and directories at arbitrary paths. This allows host directory listings to be disclosed to sandboxed...

CVE-2026-96282: Improper Link Resolution Before File Access

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be...

CVE-2026-100723: Exposure of Sensitive Information to an Unauthorized Actor

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength === length to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist require: builtin: 'zlib' ,...

CVE-2026-100722: Uncaught Exception

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in its HTTP/3 request header handling, which does not enforce the RFC 9114 section 4.3.1 requirement that an :authority pseudo-header and a literal host header field carry the same value when both are present. An...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in HttpConversionUtil.toHttp3HeadersHttpMessage, boolean, reached through Http3FrameToHttpObjectCodecfalse, which processes the Host header before the authority carried in an absolute-form request-target, so a...

CVE-2026-100716

Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export DataDump cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir contains an off-by-one in its path-component walk that skips the first segment...

CVE-2026-100664

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

CVE-2026-100659

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

CVE-2026-100664

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

UBUNTU-CVE-2026-100664

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

CVE-2026-100716 Froxlor before 2.3.12 Privilege Escalation via Symlink

Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export DataDump cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir contains an off-by-one in its path-component walk that skips the first segment...

CVE-2026-100716

The Froxlor server administration panel (versions 2.3.10 and earlier ) is vulnerable to a privilege escalation flaw in the customer data-export (DataDump) cron. The root cause is an off-by-one error in Froxlor leFileDir::makeCorrectDir(), which skips the first path segment below the customer home...

CVE-2026-100715 Froxlor before 2.3.12 Arbitrary File Deletion via Symlink

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 deleteFtpData, queued when an FTP account is deleted, calls FileDir::makeCorrectDir without the $fixedhomedir argument, so the symlink component walk is skipped, a...

EUVD-2026-87689

Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export DataDump cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir contains an off-by-one in its path-component walk that skips the first segment...

CVE-2026-100715

Froxlor versions through 2.3.10 are vulnerable to arbitrary file deletion due to a symlink following flaw in the FTP data deletion cron task (deleteFtpData ). The vulnerability occurs because the FileDir::makeCorrectDir() function is called without the $fixed_homedir argument, causing the symlink...

EUVD-2026-87688

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 deleteFtpData, queued when an FTP account is deleted, calls FileDir::makeCorrectDir without the $fixedhomedir argument, so the symlink component walk is skipped, a...

CVE-2026-100716 Froxlor before 2.3.12 Privilege Escalation via Symlink

Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export DataDump cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir contains an off-by-one in its path-component walk that skips the first segment...

CVE-2026-100664 Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

CVE-2026-100664 Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...