CVE-2026-66070

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

AZL-105801 CVE-2026-66070 affecting package rabbitmq-server 3.13.7-9

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

UBUNTU-CVE-2026-66070

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

CVE-2026-66070 RabbitMQ: CORS * reflects Origin with Allow-Credentials

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

CVE-2026-66070 RabbitMQ: CORS * reflects Origin with Allow-Credentials

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

EUVD-2026-85625

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

CVE-2026-66070 RabbitMQ: CORS * reflects Origin with Allow-Credentials

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

CVE-2026-66070

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

CVE-2026-90903

Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products action. All other administrative AJAX endpoints orders, coupons, media,...

EUVD-2026-85558

Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products action. All other administrative AJAX endpoints orders, coupons, media,...

CVE-2026-90903

The Joomla Extension - joomshaper.com 's Easy Store extension (versions 1.0.0-3.0.0 ) contains a vulnerability where the ApiController fails to verify CSRF tokens across most administrator AJAX API endpoints. While the products() action was protected, other endpoints—including orders, coupons, me...

CVE-2026-90903 Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products action. All other administrative AJAX endpoints orders, coupons, media,...

CVE-2026-90900

The Easy Store extension (versions 1.0.0-3.0.0 ) by joomshaper.com for Joomla is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a missing CSRF token verification on the product review submission endpoint (index.php?option=com_easystore&task=product.addReview), where t...

CVE-2025-63564

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...

CVE-2026-47874

A flaw was found in the Reactor Netty HTTP server. A remote attacker can exploit this vulnerability by sending HTTP/1.1 pipelined requests over a single connection. This action causes the server to consume an excessive amount of memory, leading to a Denial of Service DoS...

SUSE CVE-2026-93567

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...

CVE-2026-93130

A flaw was found in the Linux kernel's dell-wmi-base module, which handles system management functions for Dell hardware. This vulnerability is a resource leak, meaning that system resources are not properly released after use. When the dell-wmi-base module fails to load, it does not correctly...

EUVD-2025-210998

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...

CVE-2026-66070: Permissive Cross-domain Policy with Untrusted Domains

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

PT-2026-105065

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...