CVE-2026-107370 Improper Request Handling for Active Directory Logins in auth0-lock

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters...

axios: Axios: HTTP header injection via inherited prototype properties

A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...

PT-2026-91430

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation...

Incorrect Authorization

Clerk is vulnerable to Incorrect Authorization. The vulnerability is due to improper request matching in createRouteMatcher, which allows an attacker to craft requests that bypass middleware protection and access downstream handlers...

CVE-2026-20069

A vulnerability in the VPN web services component of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct browser-based attacks against users of an affected device. This...

WordPress plugin: Vulnerability in cross-site request forgeing in Easy Property Listings

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is ...

Beward N100 security vulnerabilities

Beward N100 is an IP camera from the Russian company Beward. A security vulnerability exists in Beward N100 version M2.1.6, which stems from a lack of proper request validation and could lead to a cross-site request forgery attack...

GHSA-WCGJ-F865-C7J7 Improper Request Caching Lookup in the Auth0 Next.js SDK

Description When using affected versions of the Next.js SDK, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. Am I Affected? You are affected if you meet the following preconditions: - Applications using the auth0/nextjs-aut...

Fortinet FortiClient Enterprise Management Server SSRF

The vulnerability of the Fortinet FortiClient Enterprise Management Server EMS server lies in the insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack by sending a specially crafted HTTP or HTTPS request...

EUVD-2017-3388

Malware in sbrugna...

EUVD-2019-0995

Malware in sbrugna...

EUVD-2025-7453

Malicious code in bioql PyPI...

EUVD-2024-28054

Malicious code in bioql PyPI...

CVE-2025-54477 Joomla! Core - [20250902] User-Enumeration in passkey authentication method

Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method...

Gardyn 4 security vulnerabilities

Gardyn 4 is a home vertical hydroponic growing system from Gardyn USA. A security vulnerability exists in Gardyn 4 that stems from improper request handling and could lead to information disclosure and execution of arbitrary code...

Websoft HCM Automation Software Disclosure

The vulnerability of Websoft HCM’s automation software for HR processes is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

X.Org X Server security vulnerabilities

X.Org X Server is an X Window System display server from the X.Org Foundation. A security vulnerability exists in X.Org X Server that stems from improper request handling and could lead to a denial of service...

OctoPrint security vulnerabilities

OctoPrint is an open source application from OctoPrint. It provides a fast web interface for controlling consumer 3D printers. A security vulnerability exists in OctoPrint 1.11.1 and earlier versions that stems from improper request handling and could lead to a denial of service...

Polarion ALM Unauthorized Access

The vulnerability of the Polarion ALM application lifecycle management software is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2024-56924

A Cross Site Request Forgery CSRF vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page pagesaccount, potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information...