CVE-2026-107715 Mechanize sends credential headers to another host after an HTTP redirect

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanizerequestheaders= is reapplied by Mechanize::HTTP::Agentrequestaddheaders even after...

CVE-2026-107399

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

EUVD-2026-95318

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

CVE-2026-107399

The Mechanize library (prior to version 2.14.1 ) fails to enforce an origin trust boundary within the Mechanize::HTTP::Agent#response_follow_meta_refresh function when follow_meta_refresh is enabled. This flaw allows a page containing a meta refresh to an external origin to cause the library to r...

CVE-2026-107399

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

CVE-2026-107399 Mechanize sends credential headers to another origin after a meta refresh

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

CVE-2026-107399 Mechanize sends credential headers to another origin after a meta refresh

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

CVE-2026-107395

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing...

CVE-2026-104075

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent...

EUVD-2026-95213

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing...

CVE-2026-107395

The event management system Indico is vulnerable to a missing access check in its legacy session export API, used by the Flask-Multipass authentication system. Versions prior to 3.3.13 allow an authenticated user to retrieve details for a restricted session—such as the title, description, and con...

CVE-2026-107395 Indico: Missing access check in legacy session export API

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing...

CVE-2026-107395 Indico: Missing access check in legacy session export API

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing...

Exploit for Insecure Default Initialization of Resource in Apache Superset

Apache Superset Default SECRETKEY Session Forgery CVE-2023-2...

cPanelSniper

cPanelSniper CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection 4-stage exploit chain · Interactive WHM Shell · Bulk scanner · Pipeline ready · stdlib only Overview cPanelSniper is a focused exploitation framework for CVE-2026-41940 , a critical authentication...

cPanelSniper

cPanelSniper CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection 4-stage exploit chain · Interactive WHM Shell · Bulk scanner · Pipeline ready · stdlib only Overview cPanelSniper is a focused exploitation framework for CVE-2026-41940 , a critical authentication...

cpanel-pwn

cpanel-pwn cPanel/WHM security testing toolkit. Implements the CVE-2026-41940 CRLF injection authentication bypass and post-exploitation privilege pivoting. Tools Script| Purpose ---|--- cpanelexploit.py| CVE-2026-41940: CRLF injection → WHM auth bypass → root access CVE-2026-41940 Type: CRLF...

EUVD-2026-95250

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent...

CVE-2026-104075 TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent...

CVE-2026-104075

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 are susceptible to an authentication bypass vulnerability in the web management login endpoint (POST /tvu/Login ). By submitting a crafted HTTP request with an empty or absent UserName parameter, remote unauthenticated ...