CVE-2026-101065

Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the README starts the container listening on 0.0.0.0:8080 with authentication disabled by default. When authentication is disabled, every request is mapped...

EUVD-2026-88025

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboardhost setting is empty, /api/v1/oauth2/provider cmd/dashboard/controller/oauth2.go reflects the attacker-supplied HTTP Host header into the redirecturi sent to the identity...

CVE-2026-101090

Nezha version 2.2.3 is vulnerable to a Host header injection regression in the OAuth2 redirect endpoint located at /api/v1/oauth2/{provider} (specifically in cmd/dashboard/controller/oauth2.go). When the optional dashboard_host setting is empty, the application reflects an attacker-supplied HTTP ...

CVE-2026-101090 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboardhost setting is empty, /api/v1/oauth2/provider cmd/dashboard/controller/oauth2.go reflects the attacker-supplied HTTP Host header into the redirecturi sent to the identity...

CVE-2026-101090 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboardhost setting is empty, /api/v1/oauth2/provider cmd/dashboard/controller/oauth2.go reflects the attacker-supplied HTTP Host header into the redirecturi sent to the identity...

CVE-2026-101090 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboardhost setting is empty, /api/v1/oauth2/provider cmd/dashboard/controller/oauth2.go reflects the attacker-supplied HTTP Host header into the redirecturi sent to the identity...

DEBIAN-CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

UBUNTU-CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279 Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

EUVD-2026-88013

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-100870

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for know...

CVE-2026-100870 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for know...

CVE-2026-100870 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for know...

CVE-2026-100870 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for know...

EUVD-2026-87942

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for know...

CVE-2026-100870

Sylius versions prior to 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 are vulnerable to administrator password-reset poisoning. The software builds password-reset links using the request Host header without proper validation. This allows unauthenticated attackers to use forged Host headers to red...

CVE-2026-100664

A flaw was found in Netty's HTTP/3 codec. When converting HTTP/1 requests to HTTP/3, the codec improperly prioritizes the Host header over the request-target authority. A remote, unauthenticated attacker can exploit this authority confusion by sending a request containing conflicting destination...