CVE-2026-86350: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from...

Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs. The submodule did not...

CVE-2026-93528: Exposure of Sensitive Information to an Unauthorized Actor

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key...

PT-2026-97201

Name of the Vulnerable Software and Affected Versions NP Quote Request for WooCommerce WordPress plugin versions prior to 2.4.16 Description An issue exists where the software fails to verify order ownership before rendering order details. This allows unauthenticated attackers to view the orders ...

CVE-2026-95602: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...

CVE-2026-84168: Exposure of Sensitive Information to an Unauthorized Actor

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...

PT-2026-97619

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.1 through 19.2.6 GitLab CE/EE versions 19.3 through 19.3.2 GitLab CE/EE versions 19.4 Description An issue exists where an authenticated user can spoof merge request authorship and attribute content to arbitrary existi...

CVE-2025-63564

The Moodle Socialwall plugin versions v.3.0 through v.3.3 are affected by a SQL injection vulnerability. An attacker can exploit this flaw by sending crafted HTTP requests , which may lead to the execution of arbitrary code . The vulnerability is classified with a CRITICAL base severity score of ...

CVE-2026-96446: Missing Authorization

A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that...

CVE-2026-76086: Missing Authorization

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

CVE-2026-92284: Allocation of Resources Without Limits or Throttling

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and proce...

Critical: ipa security, bug fix, and enhancement update

AlmaLinux Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fixes: ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ip...

PT-2026-97553

Name of the Vulnerable Software and Affected Versions sfturing hosp order versions up to 627f426331da8086ce8fff2017d65b1ddef384f8 Description A remote attack can lead to cross-site request forgery, which occurs when a malicious site tricks a user's browser into performing an unwanted action on a...

PT-2026-97490

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...

Linux Distros Unpatched Vulnerability : CVE-2026-95362

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site request forgery in DevTools. CVE-2026-95362 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

PT-2026-97662

Name of the Vulnerable Software and Affected Versions Drupal Webform versions 0.0.0 through 6.2.12 Drupal Webform versions 6.3.0 through 6.3.1 Description An incorrect authorization issue in the Webform Submission Export/Import submodule allows for Server Side Request Forgery SSRF, a condition...

GitLab 19.1 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-92530)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an...

Linux Distros Unpatched Vulnerability : CVE-2026-62987

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses...

PT-2026-97287

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Pushed Authorization Request PAR implementation. When the silent authentication path prompt=none is used, the authorization process may skip specific steps for users who...

Apache Tomcat 9.0.0.M1 < 9.0.122 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.122. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.122security-9 advisory. - CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled...