CVE-2026-96374 Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178

Cross-Site Request Forgery CSRF vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5...

CVE-2026-96374

The Project Browser module for Drupal is vulnerable to a Cross-Site Request Forgery (CSRF) issue. The module fails to sufficiently validate administrative actions, which could allow an attacker to perform unauthorized actions such as applying recipes or enabling modules via the web user interface...

EUVD-2026-107823

Cross-Site Request Forgery CSRF vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5...

CVE-2026-96388 Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

Cross-Site Request Forgery CSRF vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4...

CVE-2025-10377

Proof of Concept CVE-2025-10377 Cross-Site Request Forgery CSRF in Plugin System Dashboard Funtion sdtogglelogs Vulnerability Type: Cross-Site Request Forgery CSRF Affected Function: sdtogglelogs CVSS v3.1: 4.3 Medium Vector: AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N Note: Score reflects unauthorized...

CVE-2026-14288

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access...

CVE-2019-16278

CVE-2019-16278 - Nostromo nhttpd RCE Vulnerability Description Remote Code Execution vulnerability in Nostromo nhttpd versions 2&1 Usage python3 cve-2019-16278.py Example: python3 cve-2019-16278.py 192.168.1.100 80 "id" python3 cve-2019-16278.py 10.10.10.10 8080 "cat /etc/passwd" python3...

CLEANSTART-2026-WK76356 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request

Security vulnerability affects the rundeck package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...

CLEANSTART-2026-UE71064 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-HK40992 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details...

CLEANSTART-2026-JT86822 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

CVE-2026-6790 affects multiple packages. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. See references for individual vulnerability details...

CVE-2025-63408

CVE-2025-63408 path-traversal.py: A re-implementation of https://github.com/eric-m-holub/double-agent/blob/main/doubleagent.py Uses uuids as part of the requested filename to avoid remote server crashing after first path traversal exploitation. run.py / shell.py: wrapper on top of podman to run...

EUVD-2026-107663

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarte...

Critical: dotnet9.0

Issue Overview: Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-70188 Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core...

Critical: dotnet10.0

Issue Overview: Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-70188 Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core...

Critical: dotnet8.0

Issue Overview: Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-70188 Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core...

PT-2026-121666

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest ...

Linux Distros Unpatched Vulnerability : CVE-2025-31699

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully...

Amazon Linux 2023 : aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 (ALAS2023-2026-3248)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3248 advisory. Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-70188...

Linux Distros Unpatched Vulnerability : CVE-2026-110354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service persistent worker-thread CPU exhaustion via an HTTP/1.1 chunked...