CVE-2026-71324

Traefik , an open-source HTTP reverse proxy and load balancer, is vulnerable to cross-user response poisoning in its default proxy when forwarding HTTP/2 or HTTP/3 CONNECT requests to an HTTP/1.1 upstream via a shared net/http.Transport . If the upstream returns a keep-alive non-2xx response with...

CVE-2026-71324 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

CVE-2026-71324 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

CVE-2026-71324 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

WordPress Football Pool plugin <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting vulnerability

Authenticated Subscriber+ Reflected Cross-Site Scripting vulnerability discovered by whitesector in WordPress Plugin Football Pool versions = 2.13.4...

Malicious code in dolyame-ui-react-version-switch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ee4e207fd01bae956d7fe084377ecea438f81774ea01ca6b02a50c1962c6cca Package advertises itself as a React UI helper but its index.js unconditionally requires./vendor at load time. vendor.js selects a platform-specific...

EUVD-2026-53260

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFLSHAREDFRAG in iptfsskbaddfrags When iptfsskbaddfrags copies frag references from the source frag walk into a new SKB, it increments the page reference count via skbfragref but does not propagate...

CVE-2026-8790

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...

CVE-2026-8790

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...

CVE-2026-8790

CVE-2026-8790 affects the Football Pool WordPress plugin up to version 2.13.4. The issue is a Reflected Cross-Site Scripting in the Shoutbox widget, where the raw POST value of the shouttext parameter is echoed into a textarea via printf('%s', ...) without HTML escaping when a nonce check fails, ...

CVE-2026-8790 Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...

EUVD-2026-53040

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...

PT-2026-67966

Name of the Vulnerable Software and Affected Versions Football Pool plugin for WordPress versions prior to 2.13.5 Description Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce check, the shouttext...

CVE-2026-8790: Improper Neutralization of Input During Web Page Generation

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...

django-database-conn-pool (>=1.1.0, <=1.1.1), django-learngual (>=0.39.0, <=0.895.0) +2 more potentially affected by CVE-2026-15307 via django (4.0.8)

django PYPI version 4.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-database-conn-pool =1.1.0, =0.39.0, =0.11.21, =0.50.3 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

curl: CVE-2026-18924: HTTP/2 server push UAF

A vulnerability was discovered in libcurl versions 8.21.0 and later, where a use-after-free issue could occur in the HTTP/2 server push functionality. The vulnerability was caused by the fact that when a pushed transfer ends, the connection's pool is not properly handled, leading to the freed...

CVE-2026-63252

In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially...

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

SummaryThe Socket.IO server is configured with alwaysconnect=True lines 78, 91 in backend/openwebui/socket/main.py and the connect handler line 329 never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact with...

RUSTSEC-2026-0243 `nostr-relay-pool` is unmaintained

The nostr-relay-pool crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into nostr-sdk starting with version 0.45.0. Users should migrate to nostr-sdk...

`nostr-relay-pool` is unmaintained

The nostr-relay-pool crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into nostr-sdk starting with version 0.45.0. Users should migrate to nostr-sdk...