A vulnerability tracked as CVE-2026-23941, known as an HTTP Request Smuggling flaw, exists in the Erlang OTP inets httpd module, a component used in some web server setups. This issue violates official web request processing standards (RFC 9112) that are designed to keep web traffic consistent and secure.The flaw stems from how the module handles ...
Continue reading
A security vulnerability has been identified in NGINX JavaScript that only affects sites using the js_fetch_proxy setting configured with at least one client-controlled NGINX variable (such as values from HTTP headers, URL arguments, or cookies) alongside a location that calls the ngx.fetch() operation.This flaw can be exploited by unauthenticated ...
Continue reading
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was ...
Continue reading
A security flaw, identified as CVE-2026-48907, exists in the JCE editor extension used by Joomla websites.
This vulnerability allows people who do not have an account or login credentials for your Joomla site to create new editor profiles on the platform. Once created, these profiles let attackers upload and run harmful PHP code directly on your ...
Continue reading
