EUVD-2026-104478

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4...

CVE-2026-111063

The AIOHTTP asynchronous HTTP client/server framework for Python and asyncio is vulnerable to a security flaw prior to version 3.14.4 . The Secure attribute for a shared cookie is not enforced, which could allow an attacker to cause a shared cookie marked as Secure to be transmitted over an unenc...

CVE-2026-111063

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4...

CVE-2026-111063 AIOHTTP: Secure attribute not enforced for shared cookie

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4...

CVE-2026-111063 AIOHTTP: Secure attribute not enforced for shared cookie

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4...

CVE-2026-111063

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4...

EUVD-2026-104467

IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process...

CVE-2026-12350 IBM MQ Deserialization of Untrusted Data

IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process...

CVE-2026-12350 IBM MQ Deserialization of Untrusted Data

IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process...

CVE-2026-12350

IBM MQ is vulnerable to a denial of service (DoS) condition due to the deserialization of untrusted data . An authenticated attacker can trigger this by sending a specially crafted asynchronous consume request , which results in the crashing of the queue manager agent process . No specific patch ...

CVE-2026-107187 Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables

A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations ma...

CVE-2026-107187

The Eptura Archibus platform is vulnerable to an unauthenticated database read via the AbCommonResources-getDataRecords workflow rule. An attacker can chain this with an authentication bypass in the isPasswordUppercase method to execute DWR requests without valid credentials. This allows unauthor...

EUVD-2026-104459

A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations ma...

CVE-2026-112308

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

Cross-site Request Forgery (CSRF)

Overview locust is a Developer friendly load testing framework Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the /stop and /stats/reset endpoints, which accepted GET requests, allowing an attacker to trick an authenticated user into visiting a malicious...

Apostrophe Technologies ApostropheCMS: Server-side Request Forgery Vulnerability

Apostrophe Technologies' ApostropheCMS has a vulnerability related to server-side request forgeing. This vulnerability stems from the AI helper, which allows editors with image-generation capabilities to create base64-encoded image records without saving the provider’s URL. This triggers image...

WordPress VikRentCar Car Rental Management System Cross-Site Request Forgery Vulnerability

The WordPress VikRentCar Car Rental Management System versions 1.4.8 and earlier have a cross-site request forgeing vulnerability. This vulnerability stems from being vulnerable to cross-site request forgeing attacks...

WAVLINK WL-WN530BE1-A has a command injection vulnerability

The WAVLINK WL-WN530BE1-A M30BE1V251117 and earlier versions have a command injection vulnerability. This vulnerability stems from the ios binary sub23B54 function, which passes the uncleaned fileid parameter of type=del in the request/protocol.csp?opt=ovpnfile to popen. A remote unauthenticated...

Agent2Agent A2A Rust SDK server request forgery vulnerability

The Agent2Agent A2A Rust SDK 0.4.3 and earlier versions have a vulnerability related to server-side request forgery. This vulnerability stems from improper handling of parameters in the HttpPushSender function of the Push Notification Handler component. The improper handling involves the paramete...

Oracle Concurrent Processing security vulnerability

Oracle Concurrent Processing versions 12.2.3 to 12.2.15 have security vulnerabilities. These vulnerabilities stem from issues with the Request Submission and Scheduling components. They could allow high-privilege attackers to log in and execute infrastructure tasks, potentially leading to...