CVE-2026-69215 Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an...

CVE-2026-69205

Http4s (a Scala HTTP library) is affected in its Ember backend, specifically the HeaderP.parse function, which uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset. This causes mismatches with RFC-compliant intermediaries,...

PT-2026-92426

The CookieJar client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for example.com is therefore sent to any host whose name merely contains...

PT-2026-92423

Summary Ember's HTTP/1.1 header parser matches the Transfer-Encoding header value with a case-sensitive substring test hValue.contains"chunked". RFC 9112 §7 requires transfer-coding names to be compared case-insensitively. A request carrying Transfer-Encoding: Chunked capital C is therefore not...

CVE-2026-73236

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

CVE-2026-73236

Apache Syncope is vulnerable to an incorrect authorization issue due to a flawed implementation of delegated administration security checks. The system relies on Realm hierarchy and prefix matches ; however, it fails to correctly distinguish between two sibling Realms that share the same initial ...

CVE-2026-73236 Apache Syncope: Cross-Realm authorization bypass in delegated administration

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

EUVD-2026-77474

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: ipv4: Handled attempts to delete multipath routes when the fibinfo contains a reference to nh. Gwangun Jung reported a buffer-overflow vulnerability in fibnhmatch: fibnhmatch+0xf98/0x1130;...

Astra Linux – Vulnerability in ffmpeg

A buffer overflow vulnerability exists in FFmpeg 4.2, specifically in the builddiffmap function within libavfilter/vffieldmatch.c. This vulnerability could allow a remote malicious user to cause a Denial of Service attack...

Astra Linux – Vulnerability in Apache2

Some modproxy configurations on the Apache HTTP Server versions 2.4.0 through 2.4.55 allow for an HTTP Request Smuggling attack. These configurations are affected when modproxy is enabled along with some form of RewriteRule or ProxyPassMatch, where a non-specific pattern matches a portion of the...

Malicious code in glob-match (npm)

The package glob-match was found to contain malicious code. --- Credit: OpenSSF source...

CLSA-2026-1789204224 Fix CVE(s): CVE-2026-19487

SECURITY UPDATE: incorrect regex match in Aho-Corasick prescan GH22892 - debian/patches/fixes/CVE-2026-19487.patch: reset the stale failed flag after a successful trie transition in the AHOCORASICK arm of Sfindbyclass in regexec.c, so the prescan is no longer aborted on a worse or non-matching...

CLSA-2026-1789132992 xdg-dbus-proxy: Fix of CVE-2026-34080

Improve detection of eavesdrop=true in the D-Bus match-rule filter to address the following vulnerability: - CVE-2026-34080: the eavesdrop= match was located with a fixed-string search, so whitespace between 'eavesdrop' and '=' was not recognised and a client could install an eavesdropping match...

CLSA-2026-1789126805 xdg-dbus-proxy: Fix of CVE-2026-34080

Improve detection of eavesdrop=true in the D-Bus match-rule filter to address the following vulnerability: - CVE-2026-34080: the eavesdrop= match was located with a fixed-string search, so whitespace between 'eavesdrop' and '=' was not recognised and a client could install an eavesdropping match...

DEBIAN-CVE-2026-89161

In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...

PT-2026-89765

Name of the Vulnerable Software and Affected Versions PCRE2 versions prior to 10.48 Description An out-of-bounds read occurs in the pcre2 match function when processing an invalid UTF subject during PCRE2 MATCH INVALID UTF matching. Recommendations Update to version 10.48 or later...

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account th...

GHSA-WPMR-8H3Q-FWJ7 Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account th...

GO-2026-6361 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths in github.com/seaweedfs/seaweedfs

SeaweedFS: Filer JWT allowedprefixes literal prefix match allows cross-tenant access to sibling paths in github.com/seaweedfs/seaweedfs...