EUVD-2026-49889

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...

CVE-2026-66746 Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...

CVE-2026-66746

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...

CVE-2026-66746

Rouille 0.4.0–3.6.2 contains an HTTP response splitting vulnerability. An attacker can inject CR/LF into attacker-controlled input, causing arbitrary response headers to be added via reflected percent-decoded query parameters or bare LF in Cookie headers into Set-Cookie headers. This enables cach...

Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities

Summary CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, it could lead to incorrect equality comparisons. Impact EntityIdentifier.equals has inverted null/self branches The...

CVE-2026-13795

An insufficient policy enforcement flaw was found in the Chrome for iOS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=476591032...

CVE-2026-13793

An insufficient policy enforcement flaw was found in the SVG component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=510829679...

CVE-2026-13945

An insufficient policy enforcement flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513226551...

CVE-2026-13864

An insufficient policy enforcement flaw was found in the WebHID component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=496399913...

CVE-2026-13937

An insufficient policy enforcement flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513046494...

CVE-2026-13897

An insufficient policy enforcement flaw was found in the Chromecast component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=501877896...

CVE-2026-13862

An insufficient policy enforcement flaw was found in the Web Authentication Passkeys & Security Keys component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=495897416...

CVE-2026-13840

An insufficient policy enforcement flaw was found in the Canvas component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514609778...

CVE-2026-13910

An insufficient policy enforcement flaw was found in the WebXR component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=507231605...

CVE-2026-13913

An insufficient policy enforcement flaw was found in the Autofill component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=508260619...

CVE-2026-13886

A policy bypass flaw was found in the Isolated Web Apps component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=500475136...

CVE-2026-13951

A policy bypass flaw was found in the USB component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513394321...

CVE-2026-13894

An insufficient policy enforcement flaw was found in the Network component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=501741117...

CVE-2026-13896

An insufficient policy enforcement flaw was found in the Glic component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=501820076...

CVE-2026-13903

An insufficient policy enforcement flaw was found in the Bluetooth component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=503912196...