PT-2026-105810

Summary When a request returns a 500, jupyter server/log.py logs a small JSON block of request headers. The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text. Impact Anyone who can read the server logs can pick tokens out of these 500 entrie...

CVE-2026-19902: Improper Neutralization of Input During Web Page Generation

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...

CVE-2026-41875

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2026-41875 Cross-Site Request Forgery in admin panel of Quick.Cart

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2026-41875

The Quick.Cart software contains a Cross-Site Request Forgery (CSRF) vulnerability within the admin config panel . An attacker can craft a malicious website that, when visited by an administrator, automatically sends a POST request to modify the administrator's login credentials and password. Whi...

CVE-2026-41875 Cross-Site Request Forgery in admin panel of Quick.Cart

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

EUVD-2026-88741

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

PT-2026-102507

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2026-41875: Cross-Site Request Forgery (CSRF)

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2026-53989: URL Redirection to Untrusted Site

Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to redirect authenticated users to attacker-controlled sites by injecting an unvalidated redirect query parameter. Attackers can craft a malicious link...

CVE-2026-94243 Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence

A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security Bundle: before 1.3.2. Users are recommended to upgrade to version 1.3.2, which fixes the issue...

CVE-2026-86049

A flaw was found in Jupyter Server. The server's logging mechanism for HTTP 500 errors fails to properly redact sensitive information. When a request results in an HTTP 500 error and includes a Referer header containing a security token, this token is written to server logs in plaintext. An...

CVE-2026-36470

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php...

PT-2026-96127

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description Cross Site Scripting XSS occurs when the application fails to properly sanitize the Referer header during POST requests to the 'index.php' endpoint. This allows the value of the header to be copied into the...

CVE-2026-36470

CuteNews v.2.1.2 is vulnerable to a Cross-Site Scripting (XSS) vulnerability within the index.php file. The root cause is that the application copies the value of the "Referer" header into the response HTML without any modification or escaping during POST messages to index.php. Exploitation detai...

CVE-2026-36470: Improper Neutralization of Input During Web Page Generation

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php...

EUVD-2026-83992

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php...

CVE-2026-36470

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php...

CVE-2026-36470

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php...

Linux Distros Unpatched Vulnerability : CVE-2026-86049

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer...