CVE-2026-87686: Authentication Bypass by Spoofing

An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socke...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.2 release and security update

Red Hat JBoss Web Server 7.0.2 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives ...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.2 release and security update

Red Hat JBoss Web Server 7.0.2 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 7.0.2 (RHSA-2026:76952)

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76952 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised ...

EUVD-2026-93496

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayonsstore.php, causing the authorization dispatcher to resolve an...

CVE-2026-104069

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

EUVD-2026-93436

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

CVE-2026-104069 HortusFox < 6.2 Remote Code Execution via Theme Import

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

CVE-2026-104069 HortusFox < 6.2 Remote Code Execution via Theme Import

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

CVE-2026-104069

HortusFox versions prior to 6.2 are vulnerable to Remote Code Execution (RCE) via the ThemeModule::startImport() function. The root cause is the direct extraction of uploaded ZIP archives into the public web root without validating filenames, extensions, or content. An authenticated administrator...

Cisco ASA Code Injection (CVE-2024-20485)

A vulnerability in the VPN web server of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this...

Brocade Fabric OS authentication and access control bypass via HTTP host header spoofing

: An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual...

Apache Configuration Injection via Unsanitized IdP Issuer Setting in Brocade Fabric OS Web Service Interface

: An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication FA, the system fails to sanitize the Identity Provider IdP issuer parameter. An authenticated administrator—or an...

PT-2026-106774

Name of the Vulnerable Software and Affected Versions Crayons plugin for SPIP versions prior to 3.5.0 Description A missing authorization flaw allows unauthenticated attackers to modify arbitrary editable object fields. This occurs when the secu anti-forgery parameter is omitted in the 'crayons...

Cisco ASA Missing Authorization (CVE-2025-20362)

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial...

Astra Linux – Vulnerability in Apache2

HTTP/2 incoming headers that exceed the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client continues to send headers, this can lead to memory exhaustion...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty versions 1.0 through 9.4.32.v20200930, 10.0.0alpha1 through 10.0.0.beta2, and 11.0.0alpha1 through 11.0.0.beta2O, on Unix-like systems, the system’s temporary directory is shared among all users on that system. A collocated user can observe the process of creating a temporary...

Astra Linux – Vulnerability in Apache2

A timing attack against modauthdigest in Apache HTTP Server 2.4.66 allows a remote attacker to bypass Digest authentication. Users are recommended to upgrade to version 2.4.67, which fixes this issue...

VulnCheck KEV: CVE-2026-94503

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...

caddy v2.11.7

a project Every site on HTTPS Caddy is an extensible server platform that uses TLS by default. Releases · Documentation · Get Help Powered by Special thanks to: Warp, built for coding with multiple AI agents Available for MacOS, Linux, & Windows Menu Features Install Build from source For...