CVE-2026-67356

ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity.createUser without permission checks. Attackers with UPDATESCHEMA permission can create triggers that execute JavaScript to create server-wid...

Fedora 44 : curl (2026-e691fbbfe7)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e691fbbfe7 advisory. - Fix trailing dot domain super cookie CVE-2026-8924 - Fix SSH improper host validation CVE-2026-9547 - Fix password leak with netrc and user in URL...

Linux Distros Unpatched Vulnerability : CVE-2026-67355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as...

Linux Distros Unpatched Vulnerability : CVE-2026-67353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size...

Linux Distros Unpatched Vulnerability : CVE-2026-67298

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in...

Linux Distros Unpatched Vulnerability : CVE-2026-67324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when enforcing its default unsafe-option gate. When an...

Duplicate Advisory: Guzzle: Host-only cookie scope is not preserved

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wm3w-8rrp-j577. This link is maintained to preserve external references. Original Description guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the...

GHSA-MJRX-74JH-7XGW Duplicate Advisory: Guzzle: Host-only cookie scope is not preserved

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wm3w-8rrp-j577. This link is maintained to preserve external references. Original Description guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the...

fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority

A flaw was found in fast-uri. This vulnerability arises because fast-uri incorrectly parses Uniform Resource Identifiers URIs when a backslash is used in place of a forward slash to introduce the authority component. This discrepancy with Node's native WHATWG URL parser can lead to host confusion...

fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority

A flaw was found in fast-uri. This vulnerability arises because fast-uri incorrectly parses Uniform Resource Identifiers URIs when a backslash is used in place of a forward slash to introduce the authority component. This discrepancy with Node's native WHATWG URL parser can lead to host confusion...

CVE-2026-67355

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session...

UBUNTU-CVE-2026-67355

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session...

CVE-2026-67355

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session...

CVE-2026-67355

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session...

CVE-2026-67355

CVE-2026-67355 affects guzzlehttp/guzzle versions before 7.15.1. The issue is that host-only cookie scope is not preserved; the request host is stored in the Domain field instead of marking cookies as host-only. As a result, attackers controlling child hosts could receive host-only cookies intend...

CVE-2026-67355

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session...

CVE-2026-67355 guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session...

CVE-2026-67355 guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session...

EUVD-2026-51845

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session...

CVE-2026-67355 guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session...