HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the pure-Python HTTP request parser in aiohttp/httpparser.py, where the method variable used to determine whether a request body should be treated as empty is incorrectly sourced from a local parameter rather...

EUVD-2026-104486

AIOHTTP: Pure-Python parser request smuggling...

CVE-2026-113866

A flaw in Thunderbird allows a network attacker to intercept user credentials during account setup. The Exchange AutoDiscover lookup incorrectly queries the domain's AutoDiscover service over unencrypted HTTP , including the user's entered credentials in the plaintext request. An attacker monitor...

CVE-2026-113866 Account password sent unencrypted during Exchange account setup

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...

CVE-2026-113866 Account password sent unencrypted during Exchange account setup

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...

EUVD-2026-105293

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...

CVE-2026-113866

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient sanitization of meta refresh elements, where a non-default configuration that permits meta tags with http-equiv and content attributes allows unsafe script or redirect destinations embedded in t...

Cross-site Scripting (XSS)

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient sanitization of meta refresh element...

CVE-2026-88041

A flaw was found in Apache Tomcat. Due to an incomplete cleanup vulnerability, HTTP Hypertext Transfer Protocol trailer headers from a previous request can persist and leak into a subsequent request processed on the same connection. This issue may allow a remote user to access sensitive request...

Malicious code in @securihackbot/depconf-stage-1792484738 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d8706d2a75c053047537a4f57f754a572a1ca4cec4cde80d00e453878013e1 The package's npm postinstall hook automatically executes on install and transmits installer-identifying data to a hardcoded remote endpoint. It...

ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

Summary CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes action, formaction, data, poster, background, later ping, xlink:href, … go through naughtyHref. A URL nested inside meta content http-equiv=refresh is not an attribute name on that list, so the embedded...

npm: ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

npm: ApostropheCMS: Incomplete CVE-2026-53606: meta http-equiv=refresh content still ships javascript: / data: URLs vulnerability discovered by ? in WordPress npm sanitize-html versions 2.18.0...

GHSA-CV27-6WVH-8X7J ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

Summary CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes action, formaction, data, poster, background, later ping, xlink:href, … go through naughtyHref. A URL nested inside meta content http-equiv=refresh is not an attribute name on that list, so the embedded...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the sanitizeOptions function in index.js when HTTP headers are supplied as a flat key/value array rather than an object. Because the array form is not converted...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the sanitizeOptions function in index.js when HTTP headers are supplied as a flat key/value array rather than an object. Because the array form is not converted...

CLSA-2026-1792518236 perl-HTTP-Tiny: Fix of CVE-2023-31486

CVE-2023-31486: fix insecure default TLS configuration - Enable automated tests during build...

CVE-2026-113661 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script...

CVE-2026-113661

The ApostropheCMS content management system is affected by a vulnerability in the sanitize-html library. Prior to version 2.18.0 , a non-default configuration allowing meta refresh elements could retain unsafe javascript: or data: URLs within the content attribute. This flaw can lead to unsafe sc...

CVE-2026-113661 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script...