urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers

A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...

urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers

A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: ansible-operator, kubeflow-pipelines, grype-fips, packer-fips, crossplane-provider-terraform, newrelic-infrastructure-agent-fips, crossplane-provider-aws-s3, compgencompare, rclone-fips, crossplane-provider-keycloak, step-kms-plugin-fips, docker-compose-fips,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: ansible-operator, kubeflow-pipelines, grype-fips, packer-fips, crossplane-provider-terraform, newrelic-infrastructure-agent-fips, crossplane-provider-aws-s3, compgencompare, rclone-fips, crossplane-provider-keycloak, step-kms-plugin-fips, docker-compose-fips,...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: kgateway, kube-arangodb, chartmuseum-fips, grype-fips, packer-fips, headlamp-fips, grype, newrelic-infrastructure-agent-fips, neuvector-fips, helm-operator, docker-compose-fips, gatekeeper, docker-fips, xeol, helm-exporter, kots, syft, redpanda-operator,...

CVE-2026-12151 vulnerabilities

Vulnerabilities for packages: renovate, vitess, node-gyp, npm, actions-runner, gemini-cli, code-server, pelias-api, prism, py3-captum, haraka, saf, kibana...

CVE-2026-6733 vulnerabilities

Vulnerabilities for packages: renovate, vitess, node-gyp, npm, actions-runner, gemini-cli, code-server, pelias-api, prism, py3-captum, haraka, saf, kibana...

GHSA-G8M3-5G58-FQ7M vulnerabilities

Vulnerabilities for packages: renovate, vitess, node-gyp, npm, actions-runner, gemini-cli, code-server, pelias-api, prism, py3-captum, haraka, saf, kibana...

GHSA-P88M-4JFJ-68FV vulnerabilities

Vulnerabilities for packages: renovate, vitess, node-gyp, npm, actions-runner, gemini-cli, code-server, pelias-api, prism, py3-captum, haraka, saf, kibana...

CVE-2026-9679 vulnerabilities

Vulnerabilities for packages: renovate, vitess, node-gyp, npm, actions-runner, gemini-cli, code-server, pelias-api, prism, py3-captum, haraka, saf, kibana...

GHSA-35P6-XMWP-9G52 vulnerabilities

Vulnerabilities for packages: renovate, vitess, node-gyp, npm, actions-runner, gemini-cli, code-server, pelias-api, prism, py3-captum, haraka, saf, kibana...

CVE-2026-11525 vulnerabilities

Vulnerabilities for packages: renovate, vitess, node-gyp, npm, actions-runner, gemini-cli, code-server, pelias-api, prism, py3-captum, haraka, saf, kibana...

CVE-2026-8378

The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability...

CVE-2026-8379

The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating...

EUVD-2026-38419

The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability...

CVE-2026-8379 Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download

The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating...

CVE-2026-8378

The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability...

CVE-2026-8379

The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating...

CVE-2026-8378

CVE-2026-8378 affects the WordPress plugin “Frontend File Manager” up to version 23.6. The vulnerability is a Stored Cross-Site Scripting (XSS) in the frontend file-rename endpoint: the plugin does not sanitize or escape the submitted filename before storing it as post meta and re-rendering it in...

CVE-2026-8378 Frontend File Manager Plugin <= 23.6 - Subscriber+ Stored Cross-Site Scripting via File Rename

The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability...