PT-2026-135400

Name of the Vulnerable Software and Affected Versions @fastify/cors versions 8.2.0 through 11.3.x Description An application using the CORS plugin for the Fastify web framework may crash during a CORS preflight request if the plugin is registered with a non-default onSend hook option. When an...

PT-2026-135407

Name of the Vulnerable Software and Affected Versions fastify versions 5.8.0 through 5.12.7 Description A denial of service issue exists when the server is configured with a nonzero handlerTimeout and a route returns a streaming response. If a request stream remains open beyond the timeout after...

certstream-server-rust

certstream-server-rust A Certstream server written in Rust. It monitors Certificate Transparency CT logs and streams newly issued SSL/TLS certificates over WebSocket and Server-Sent Events SSE. Overview Certstream aggregates certificates from Certificate Transparency logs and streams them in real...

CLEANSTART-2026-QD05281 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE)

Security vulnerability affects the thingsboard package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE...

CLEANSTART-2026-GG04244 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)

Security vulnerability affects the apache-hive package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

CLEANSTART-2026-DI06690 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...

CVE-2026-107268

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2...

EUVD-2026-113568

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2...

PT-2026-132265

Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0...

EUVD-2026-109728

Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary Assistant: from n/a through 3.42...

undici: undici: Denial of Service via memory exhaustion in EventSource client

A flaw was found in undici. A malicious server can trigger a Denial of Service DoS by exhausting application memory. When an application connects to an untrusted Server-Sent Events SSE feed, the EventSource parser does not properly limit retained internal state when processing fragmented lines or...

SUSE CVE-2026-109924

undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields...

PT-2026-128602

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Serialize ACL scheduling with channel deletion hci chan sent selects a channel under RCU but drops the read lock before accessing chan-conn and returning the channel. The ACL and LE schedulers then use its...

CVE-2026-110361

Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1...

CVE-2026-109924

undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields...

PT-2026-114903

Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1...

PT-2026-115101

Name of the Vulnerable Software and Affected Versions undici versions 6.5.0 through 6.29.0 undici versions 7.0.0 through 7.30.0 undici versions 8.0.0 through 8.12.1 Description The EventSource client in this Node.js HTTP client library can be forced to exhaust process memory by a malicious...

CVE-2026-108489: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3...

PT-2026-109658

Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data.This issue affects WP Rollback: from n/a through 3.1.2...

CLEANSTART-2026-MH81901 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments

Security vulnerability affects the apache-nifi-registry package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...