CVE-2026-111924

Versions of Fleet prior to 4.83.0 are vulnerable to a Denial of Service (DoS) attack caused by unbounded gzip decompression . An unauthenticated attacker can exhaust server memory by sending small, highly compressed request bodies to unauthenticated endpoints using the Content-Encoding: gzip head...

EUVD-2026-103292

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during...

CVE-2026-111924 Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during...

EUVD-2026-103314

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATIONED...

CVE-2026-111906

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATIONED...

Grunfink SNac2 buffer error vulnerability

The grunfink snac2 version prior to 2.93 contained a buffer overflow vulnerability. This vulnerability stemmed from a heap-based buffer overflow in the xsjsonloadlexer function. Unauthorized remote attackers could exploit this vulnerability by sending a POST request to activitypubposthandler,...

gitify Cross-Site Request Forgery Vulnerability

Versions of Gitify prior to 7.10.0 have a cross-site request forgeing vulnerability. This vulnerability stems from the omission of OAuth state verification in performGitHubWebOAuth, which may lead to cross-site request forgery during login processes. Attackers can bind the victim’s client to thei...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.10 contains a security vulnerability. This vulnerability arises from handling empty FILS-related request payloads, where zero-length allocations return ZEROSIZEPTR. In this process, sginitone places invalid pages into the scatterlist, which may trigger a kernel bug or...

Dyad Cross-Site Request Forgery Vulnerability

Dyad 1.16.0 and earlier versions have a security vulnerability. This vulnerability stems from improper handling of the OAuth Callback Handler component, which may allow remote attackers to launch cross-site request fraud attacks...

curl: CRLF injection in the HTTP request-line via `CURLOPT_REQUEST_TARGET` (`--request-target`)

Summary The CURLOPTREQUESTTARGET option string reaches the wire with no CR/LF neutralization, even though it is formatted directly into the HTTP request-line, which is terminated by CRLF. Curlsetstropt lib/setopt.c stores the option string after checking only the 8 MB length cap CURLMAXINPUTLENGT...

curl: CRLF injection in the RTSP request-line and Transport header via `CURLOPT_RTSP_STREAM_URI` and `CURLOPT_RTSP_TRANSPORT`

Summary Two RTSP option strings reach the wire with no CR/LF neutralization, even though each is formatted directly into an RTSP request-line or header field that is terminated by CRLF. Curlsetstropt lib/setopt.c stores each option string after checking only the 8 MB length cap CURLMAXINPUTLENGTH...

CVE-2026-92978

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect...

CVE-2026-92978

The User Registration & Membership plugin for WordPress (versions up to and including 5.2.8 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is missing or incorrect nonce validation on the trigger_bulk_action() function. Specifically, an attacker can bypass nonce chec...

CVE-2026-92978 User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect...

CVE-2026-92978 User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect...

MGASA-2026-0510 Updated python-django package fixes security vulnerabilities

Potential denial-of-service vulnerability in getsupportedlanguagevariant. CVE-2026-77050 Potential denial-of-service vulnerability in HTTP header parsing. CVE-2026-84429 Potential request forgery via spatial lookup byte values. CVE-2026-87890 Privilege abuse in model formsets with editable primar...

Updated python-django package fixes security vulnerabilities

Potential denial-of-service vulnerability in getsupportedlanguagevariant. CVE-2026-77050 Potential denial-of-service vulnerability in HTTP header parsing. CVE-2026-84429 Potential request forgery via spatial lookup byte values. CVE-2026-87890 Privilege abuse in model formsets with editable primar...

CLEANSTART-2026-SU71305 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details...

Fedora 44 : python-django6 (2026-dbd9eb6961)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dbd9eb6961 advisory. Update Django 6 to version 6.1.2 - Fixes CVE-2026-77050 low: Potential denial-of-service vulnerability in getsupportedlanguagevariant - Fixes...

Fedora 43 : python-django5 (2026-a7b8ff851a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a7b8ff851a advisory. Update Django 5 to version 5.2.18 - Fixes CVE-2026-77050 low: Potential denial-of-service vulnerability in getsupportedlanguagevariant - Fixes...