CVE-2026-18825: Origin Validation Error

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CLSA-2026-1790520250 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 3.0.1-tuxcare.1...

CVE-2026-100744

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744

A flaw in coollabsio Coolify versions up to 4.1.2 within the Route-Level Middleware component leads to a missing authorization vulnerability. The issue resides in an unknown function within the app/Http/Middleware/CanUpdateResource.php file. This flaw can be triggered via a remote manipulation at...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

EUVD-2026-87817

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744: Missing Authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

[SECURITY] [DSA 6519-1] swift security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6519-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 26, 2026 https://www.debian.org/security/faq -...

Debian dsa-6519 : python3-swift - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6519 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6519-1 [email protected] https://www.debian.org/security/ Moritz...

BIT-OAUTH2-PROXY-2026-76835 OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real reque...

Ubuntu 26.04 LTS : OpenStack Swift vulnerability (USN-8821-1)

The remote Ubuntu 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8821-1 advisory. It was discovered that OpenStack Swift incorrectly handled truncated aws-chunked PUT request bodies in its s3api middleware. An authenticated attacker could...

USN-8821-1: OpenStack Swift vulnerability

It was discovered that OpenStack Swift incorrectly handled truncated aws-chunked PUT request bodies in its s3api middleware. An authenticated attacker could possibly use this issue to cause OpenStack Swift to use excessive resources, leading to a denial of service...

USN-8821-1 swift vulnerability

It was discovered that OpenStack Swift incorrectly handled truncated aws-chunked PUT request bodies in its s3api middleware. An authenticated attacker could possibly use this issue to cause OpenStack Swift to use excessive resources, leading to a denial of service...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

DEBIAN-CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

UBUNTU-CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

EUVD-2026-85786

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149

In OpenStack Swift versions before 2.38.2 , a vulnerability exists because the tempurl middleware fails to reject the X-Copy-From header on PUT requests. Since the TempURL signature only validates the method, expiry, and path, an attacker with a valid PUT TempURL for a single object can include a...