CVE-2026-86805

The GNU C Library (glibc) versions 2.14 through 2.44 contain a time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so ). When processing setuid/setgid (AT_SECURE) programs, the loader validates a lexically normalized search path for $ORIGIN in DT_RPATH but subsequently ...

EUVD-2026-84540

A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexically normalized...

CVE-2026-86805 AT_SECURE programs may load attacker-controlled code via $ORIGIN

A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexically normalized...

CVE-2026-86805 AT_SECURE programs may load attacker-controlled code via $ORIGIN

A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexically normalized...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

CVE-2026-90882

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's brows...

CVE-2026-90882 Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's brows...

EUVD-2026-84343

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's brows...

CVE-2026-94504 Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...

EUVD-2026-84183

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

PT-2026-96694

Name of the Vulnerable Software and Affected Versions open-vsx.org affected versions not specified Description The deployment of the service returned an Access-Control-Allow-Origin header that reflected the requesting origin combined with Access-Control-Allow-Credentials: true on authenticated...

CVE-2026-77912: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

The vulnerability of the contact search component of the SOGo software for collaborative work lies in the lack of a password recovery mechanism, allowing attackers to gain unauthorized access to users’ accounts.

The vulnerability of the contact search component in the SOGo software for collaborative work is related to the lack of a password recovery mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to a user’s account through specially craft...

Linux Distros Unpatched Vulnerability : CVE-2026-85717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and fr...

CVE-2026-93340

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

CVE-2026-59814

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resourceid= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A...

CVE-2026-46650

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character...