CVE Vulnerability Advisory Database

[Affected Scope] All web applications utilizing Starlette ASGI framework prior to version 1.0.1

[Impact] Malformed Host headers can cause a discrepancy between the actual routed path and request.url.path, allowing attackers to bypass URL-based security middleware and access controls

[Mitigation] Immediately upgrade the Starlette package to version 1.0.1 or higher

[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled

[Impact] Incomplete fix for CVE-2026-29146 allows attackers to bypass the EncryptInterceptor, leading to the transmission of sensitive session data in plaintext across the network

[Mitigation] Immediately upgrade to patched Apache Tomcat versions 11.0.21, 10.1.54, or 9.0.117

[Affected Scope] Fortinet FortiOS versions 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, and all versions of 7.2, 7.0, and 6.4

[Impact] A remote unauthenticated attacker with prior filesystem-level access can bypass existing symbolic link persistency mitigations via crafted HTTP requests to expose sensitive information

[Mitigation] Immediately upgrade to the patched firmware versions recommended in the official Fortinet advisory (FG-IR-25-934)

[Affected Scope] All supported versions of Windows 10, Windows 11, and Windows Server utilizing Microsoft Defender SmartScreen

[Impact] Attackers can bypass Mark-of-the-Web (MotW) warnings and SmartScreen prompts entirely, leading to arbitrary code execution when a user opens a crafted malicious file

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or restrict the execution of unverified downloaded files via Group Policy

[Affected Scope] MinIO Multi-Cloud Object Storage deployments prior to RELEASE.2023-03-20T20-16-18Z

[Impact] An attacker can bypass metadata bucket name validation to upload arbitrary objects into any bucket, potentially leading to data tampering or system compromise

[Mitigation] Immediately upgrade MinIO to RELEASE.2023-03-20T20-16-18Z or later, or disable the browser Console API as a temporary workaround

[Affected Scope] VMware vCenter Server versions 6.5, 6.7, and 7.0 without the VMSA-2021-0020 patch applied

[Impact] An unauthenticated attacker with network access to port 443 can bypass proxy restrictions via improper URI normalization, gaining unauthorized access to internal endpoints

[Mitigation] Immediately upgrade vCenter Server to the patched versions recommended in VMware Advisory VMSA-2021-0020

[Affected Scope] Google Chrome prior to version 91.0.4472.77

[Impact] Remote attackers can bypass navigation restrictions and popup blocking policies via a crafted iframe, leading to unauthorized redirections

[Mitigation] Immediately update Google Chrome to the latest stable version (91.0.4472.77 or higher)

[Affected Scope] Citrix ADC and Gateway versions prior to 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14, 10.5-70.18, and Citrix SDWAN WAN-OP

[Impact] Unauthenticated remote attackers can bypass access controls to access sensitive endpoints, potentially leading to Local File Inclusion (LFI) and information disclosure

[Mitigation] Immediately apply the official firmware updates provided by Citrix to resolve the vulnerability

[Affected Scope] Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 (prior to 4.2.0.CP09) and 4.3 (prior to 4.3.0.CP08).

[Impact] Remote attackers can bypass authentication on the JMX-Console by utilizing non-standard HTTP methods (such as HEAD), allowing unauthorized administrative actions.

[Mitigation] Apply the official Cumulative Patch (CP), or modify the web.xml configuration to enforce authentication across all HTTP methods.