Apache Traffic Server input validation error vulnerability

A input validation error vulnerability exists in Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. This vulnerability arises when a client sends a POST request containing Expect: 100-continue, and the source server responds before readin...

hMailServer cross-site request forgery vulnerability

Versions 6.0.0 through 6.3.6 of hMailServer contain a cross-site request forgery vulnerability. This flaw arises because the REST API’s cross-site request forgery protection only applies to cookie sessions and does not cover HTTP Basic authentication. As a result, remote attackers may exploit the...

Splunk Enterprise cross-site request forgery vulnerability

Versions prior to Splunk Enterprise 10.4.4, 10.2.8, 10.0.11, and 9.4.16 contain a cross-site request forgery vulnerability. This vulnerability arises because the REST API of the federated provider accepts GET requests to modify its status. Unauthenticated attackers can trick users with...

Data Intelligence Lab@HKU Vibe-Trading prompt injection vulnerability

In Data Intelligence Lab@HKU Vibe-Trading versions 0.1.0 through 0.1.7, there is a prompt injection vulnerability. This occurs because the agent injects commands into documents or web pages; BashTool and BackgroundRunTool pass the commands generated by the model directly to subprocess.run execute...

Grokability Snipe-IT side-channel information leakage vulnerability

Versions of Grokability Snipe-IT prior to 8.7.0 contain a side-channel information disclosure vulnerability. This vulnerability stems from server-side request forgery within the webhook testing functionality, enabling super administrators to discover internal network addresses including loopback...

SvelteKit server-side request forgery vulnerability

Versions of SvelteKit prior to 3.0.0 contain a server-side request forgery vulnerability. This vulnerability arises from self-fetch fallback behavior that automatically follows HTTP redirects. Attackers can manipulate the Host or forwarded headers to redirect the fallback requests to their own...

Coraza - Web Application Firewall: Input validation error vulnerability

Coraza – Web Application Firewall versions 3.0.4 to 3.8.1 had a vulnerability related to input validation errors. This issue arose from an exact comparison of the entire Content-Type value during the request body processor selection. As a result, URL-encoded request bodies containing media type...

Improper handling of exceptions vulnerability in Apache Traffic Server

Versions 9.2.15, 10.1.4, and 10.2.0 of Apache Traffic Server contain a vulnerability related to improper exception handling. This occurs when a client POST request is partially closed, causing the chunk source response to be re-parsed from a reentrant write completion callback. As a result, a nul...

CVE-2026-93003

The NetX Duo Web HTTP server contains a vulnerability where the HTTP server searches the entire request packet for header fields rather than stopping at the end of the header section. This allows a header field name placed within the request body to be incorrectly reported as a header. Consequent...

CVE-2026-93003 NetX Duo Web HTTP server interprets request body content as HTTP header fields

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

EUVD-2026-105153

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

CVE-2026-93003 NetX Duo Web HTTP server interprets request body content as HTTP header fields

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

CVE-2026-93003 NetX Duo Web HTTP server interprets request body content as HTTP header fields

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

EUVD-2026-105134

Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8...

CVE-2026-112836

The VikRentCar WordPress plugin (e4jvikwp), versions up to and including 1.4.8 , is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). This flaw allows an attacker to perform unauthorized actions on behalf of a victim user. While the impact is categorized as HIGH with a C...

CVE-2026-112836 WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8...

CVE-2026-112836 WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8...

CVE-2026-94018 NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...

CVE-2026-94018 NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...

EUVD-2026-105132

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...