EUVD-2026-92313

Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Retrieve Embedded Sensitive Data.This issue affects Video Conferencing with Zoom: from n/a through 4.6.10...

CVE-2026-32584

The Smart One Click Setup – Complete Demo Import & Export WordPress plugin (versions up to and including 1.4.3 ) is vulnerable to an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201). This flaw allows an attacker to retrieve embedded sensitive data from the plugin. No spec...

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

ImpactThe SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL which creates and mounts a LiveView as the victim and POST...

CVE-2026-62058

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

AlmaLinux 9.2 [TuxCare] Security Update: grafana (ALMALINUX9.2:CLSA-2025:1758135826)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1758135826 advisory. - Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is ma...

CVE-2026-59313

A flaw was found in the Spring MVC functional web framework. This vulnerability allows for stream corruption when applications use Server-Sent Events SSE, a technology for pushing real-time updates from a server to a client. This could lead to unreliable data delivery and impact the integrity of...

PT-2026-97502

Name of the Vulnerable Software and Affected Versions Formie versions prior to 2.2.23 Formie versions prior to 3.1.31 Description An authenticated user can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data. This occurs because the...

CVE-2026-47890

A flaw was found in Spring Framework, affecting its MVC and WebFlux applications. When these applications use Server-Sent Events SSE with view fragments, a vulnerability allows for stream corruption. This can lead to unreliable data delivery and potential disruption of services. Mitigation Disabl...

CVE-2026-61593 djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a...

EUVD-2026-80856

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a...

Cross-site Request Forgery (CSRF)

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the sessionid parameter and lack...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: TCP: Do not accept ACKs for bytes that we never sent. This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow. The validation of ACK sequences currently follows the guidelines outlined in RFC 5961,...

EUVD-2026-42683

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft...

CVE-2026-62088

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4...

EUVD-2026-76191

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4...

EUVD-2026-70242

HTTPX2: Quadratic SSE line buffering can cause CPU denial of service...

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial Of Service. The vulnerability is due to stream corruption when Server-Sent Events SSE are used with functional web framework applications in Spring MVC...

EUVD-2022-56042

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes...

EUVD-2026-72108

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-pars...

CVE-2026-85605 Slink before 1.12.3 Missing Authorization on Image Comment Endpoints

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/imageId/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on...