CVE-2026-112076 alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgery

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.writefeedmetadatasync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The...

CVE-2026-112076

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.writefeedmetadatasync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The...

CVE-2026-112076

A Server-Side Request Forgery (SSRF) vulnerability exists in alexta69 MeTube up to version 2026.09.28 . The flaw originates in the Feed-metadata Thumbnail Fetch Handler component, specifically within the DownloadQueue./__write_feed_metadata_sync function located in the app/ytdl.py file. This vuln...

CVE-2026-112033 aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgery

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function adminrepwd/adminrepwdact of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request forgery...

CVE-2026-112033 aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgery

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function adminrepwd/adminrepwdact of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request forgery...

CVE-2026-112033

A security flaw exists in aircheng-org iWebShop-5 up to version 5.16 . The vulnerability is located in the Password Change component, specifically within the admin_repwd/admin_repwd_act function of the controllers/system.php file. By manipulating the password/repassword arguments, an attacker can...

CVE-2026-112033 aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgery

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function adminrepwd/adminrepwdact of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request forgery...

PT-2026-117510

IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process...

CVE-2026-12350: Deserialization of Untrusted Data

IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process...

PT-2026-117520

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.4 Description The pure Python parser in this asynchronous HTTP client/server framework accepts ambiguous HTTP request framing. This allows an unauthenticated attacker to perform request smuggling when an...

ALSA-2026:84798 Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding...

Moderate: hostapd security update

hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a "daemon" program that runs in the back-ground and acts as the backen...

PT-2026-118064

GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli...

PT-2026-117518

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.4 Description An attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications relying on...

PT-2026-117393

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...

ROS-20261019-73-0032

The vulnerability of the ASP.NET Core software platform is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions remotely...

PT-2026-117501

Name of the Vulnerable Software and Affected Versions AIOHTTP versions 2.0.0 through 3.14.3 Description Multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can exhaust these file descriptors by sending specially crafted multipart...

PT-2026-132902

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart...

PT-2026-117342

Cross-Site Request Forgery CSRF vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and...

PT-2026-117339

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...