CVE-2026-78388

IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3) are vulnerable to a cross-site request forgery (CSRF) (CWE-352). This vulnerability allows an attacker to execute malicious and unauthorized actions by leveraging a user's tru...

CVE-2026-78388 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

EUVD-2026-95271

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2026-78388 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

Cleartext Transmission Of Sensitive Information

AsyncHttpClient is vulnerable to Cleartext Transmission of Sensitive Information. The vulnerability is due to improper handling of cross-host request replay, which allows an attacker to trigger documented retry or failover paths that send the original host's request data, authorization credential...

Exploit for CVE-2020-11651

SaltStack Master Authentication Bypass CVE-2020-11651 Vulh...

CVE-2026-107781

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server...

USN-8910-1 libxml2 vulnerabilities

Yirou Yang discovered that libxml2 incorrectly handled certain XML catalogs. If a user or automated system was tricked into processing a specially crafted XML catalog, an attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service. CVE-2026-76781 It was...

RHLW-2026-37913C8C5F4BDEA1 Lightwell Security Advisory: jetty-ee10-demo-async-rest-jar 12.0.32.rhlw-00002

Red Hat Lightwell has released org.eclipse.jetty.ee10.demos:jetty-ee10-demo-async-rest-jar 12.0.32.rhlw-00002 with a backported security fix. CVE-2026-2332: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing This patched artifact is a drop-in replacement for...

RHLW-2026-7B188D550BF6BFC3 Lightwell Security Advisory: httpclient 4.5.6.rhlw-00001

Red Hat Lightwell has released org.apache.httpcomponents:httpclient 4.5.6.rhlw-00001 with a backported security fix. CVE-2020-13956: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI...

DEBIAN-CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

CVE-2026-107334

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

UBUNTU-CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

GHSA-W253-M66G-RX24 Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

Summary Coraza fails to inspect URL-encoded form bodies when their valid Content-Type contains a media-type parameter, for example: http Content-Type: application/x-www-form-urlencoded; charset=UTF-8 An unauthenticated attacker can use this header to hide the complete form body from custom Coraza...

Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

Summary Coraza fails to inspect URL-encoded form bodies when their valid Content-Type contains a media-type parameter, for example: http Content-Type: application/x-www-form-urlencoded; charset=UTF-8 An unauthenticated attacker can use this header to hide the complete form body from custom Coraza...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375

Applications generated using JHipster (versions 7.0.0 through 9.4.0) are vulnerable to SQL Injection when using Spring WebFlux , Spring Data R2DBC , and a SQL database. The vulnerability exists because the sort request parameter from paginated entity-list endpoints is passed into the createOrderB...

CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...