Monthly
DNS rebinding and local-network exposure in the Genkit Developer UI server (default port 4000) allows any attacker-controlled website visited by the developer, or any host on the developer's local network, to invoke POST /api/runAction and execute arbitrary registered Genkit actions, reading full results. The root cause is absent Host header validation combined with the server binding to all network interfaces rather than loopback only. No public exploit or CISA KEV listing has been identified; the upstream fix was merged on 2026-06-18 per GitHub PR #5587 and independently corroborated by a CISA CSAF advisory.
Header injection in SAP Approuter (the Node.js package for SAP Business AI Platform) allows unauthenticated remote attackers to send specially crafted requests that bypass header sanitization, resulting in limited unauthorized information disclosure from internal backend components. All SAP Approuter Node.js package versions below 23.0.0 are affected, with a vendor-released patch available at version 23.0.0. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the zero-authentication requirement and low attack complexity make it accessible to opportunistic actors targeting exposed SAP BTP deployments.
Host header injection in picocms/Pico through 2.1.4 allows unauthenticated remote attackers to substitute an attacker-controlled domain as the base URL for all JavaScript and CSS assets loaded by the default theme. Because Pico::getBaseUrl() in lib/Pico.php trusts unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers when base_url is not explicitly configured, the derived URL propagates unchecked into theme_url, assets_url, and plugins_url, causing every page rendered by the default theme to fetch scripts and stylesheets from the attacker's server. No public exploit is identified at time of analysis; exploitation requires a victim to load a Pico-generated page in a browser.
Host header injection in SonicWall SonicOS enables remote unauthenticated attackers to manipulate the HTTP Host header on the firewall management interface, causing redirect responses that send management users to attacker-controlled web domains. Affected version branches span the SonicOS 6.5, 7.0, 7.3, and 8.2 lines, covering a wide installed base of SonicWall firewalls. No public exploit code exists and this vulnerability has not been added to CISA KEV at time of analysis, but the unauthenticated network-accessible attack surface and management-user targeting make it a meaningful phishing risk in environments where the management interface is internet-exposed.
HCL DevOps Loop omits critical HTTP security response headers, degrading browser-enforced protections against clickjacking, MIME-type sniffing, and cross-site scripting for all users of the application. The absence of headers such as Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options does not introduce a standalone exploit path but removes a layer of defense-in-depth that browsers rely on to block client-side attack chains. CVSS assigns a low score of 3.7 with high attack complexity, reflecting that meaningful impact requires chaining this weakness with a secondary technique; no public exploit has been identified and the vulnerability is not listed in CISA KEV.
Missing HTTP security headers in the Gardyn admin panel expose Gardyn Home Firmware, Gardyn Studio Firmware, and Gardyn Cloud API to clickjacking and cross-site scripting attacks against authenticated administrators. The absence of directives such as X-Frame-Options, Content-Security-Policy frame-ancestors, and script-source restrictions allows an attacker to embed the admin panel in a malicious iframe or inject client-side scripts into the admin session context. Reported by ICS-CERT under advisory ICSA-26-183-03, no public exploit or active exploitation has been confirmed at time of analysis.
IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004 is vulnerable to HTTP header injection, caused by. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Host Header Injection in Password Manager (all versions per CPE) enables remote unauthenticated attackers to manipulate the HTTP Host header, causing the application to generate crafted links or responses that reference an attacker-controlled domain. Exploitation requires active user interaction (UI:A per CVSS 4.0 vector), limiting mass exploitation but enabling targeted phishing, password-reset link hijacking, or cache poisoning affecting dependent services. No public exploit code has been identified, and INCIBE has confirmed a vendor patch is available. This vulnerability is part of a broader set of issues disclosed simultaneously in the same INCIBE advisory.
HTTP header injection in IBM DevOps Plan 3.0.0 through 3.0.6 allows unauthenticated remote attackers to inject arbitrary HTTP headers by supplying a malicious HOST header value that the application fails to sanitize. The vulnerability (CWE-644) can be leveraged to mount cross-site scripting attacks against users, poison intermediate caches with attacker-controlled content, or hijack authenticated sessions. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the low-complexity, no-authentication-required attack surface makes this a meaningful risk for any internet-facing deployment.
HTTP header smuggling in @fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3 allows remote unauthenticated attackers to strip proxy-added security headers from upstream requests via malicious Connection header values. Attackers can retroactively remove headers intended for routing, access control, or authentication, potentially bypassing proxy-enforced security policies. CVSS 9.0 (Critical) with high integrity impact to both vulnerable and subsequent systems. EPSS 0.04% indicates low mass-exploitation probability despite proof-of-concept availability (SSVC). Vendor patches available: upgrade to @fastify/reply-from ≥12.6.2 or @fastify/http-proxy ≥11.4.4.
DNS rebinding and local-network exposure in the Genkit Developer UI server (default port 4000) allows any attacker-controlled website visited by the developer, or any host on the developer's local network, to invoke POST /api/runAction and execute arbitrary registered Genkit actions, reading full results. The root cause is absent Host header validation combined with the server binding to all network interfaces rather than loopback only. No public exploit or CISA KEV listing has been identified; the upstream fix was merged on 2026-06-18 per GitHub PR #5587 and independently corroborated by a CISA CSAF advisory.
Header injection in SAP Approuter (the Node.js package for SAP Business AI Platform) allows unauthenticated remote attackers to send specially crafted requests that bypass header sanitization, resulting in limited unauthorized information disclosure from internal backend components. All SAP Approuter Node.js package versions below 23.0.0 are affected, with a vendor-released patch available at version 23.0.0. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the zero-authentication requirement and low attack complexity make it accessible to opportunistic actors targeting exposed SAP BTP deployments.
Host header injection in picocms/Pico through 2.1.4 allows unauthenticated remote attackers to substitute an attacker-controlled domain as the base URL for all JavaScript and CSS assets loaded by the default theme. Because Pico::getBaseUrl() in lib/Pico.php trusts unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers when base_url is not explicitly configured, the derived URL propagates unchecked into theme_url, assets_url, and plugins_url, causing every page rendered by the default theme to fetch scripts and stylesheets from the attacker's server. No public exploit is identified at time of analysis; exploitation requires a victim to load a Pico-generated page in a browser.
Host header injection in SonicWall SonicOS enables remote unauthenticated attackers to manipulate the HTTP Host header on the firewall management interface, causing redirect responses that send management users to attacker-controlled web domains. Affected version branches span the SonicOS 6.5, 7.0, 7.3, and 8.2 lines, covering a wide installed base of SonicWall firewalls. No public exploit code exists and this vulnerability has not been added to CISA KEV at time of analysis, but the unauthenticated network-accessible attack surface and management-user targeting make it a meaningful phishing risk in environments where the management interface is internet-exposed.
HCL DevOps Loop omits critical HTTP security response headers, degrading browser-enforced protections against clickjacking, MIME-type sniffing, and cross-site scripting for all users of the application. The absence of headers such as Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options does not introduce a standalone exploit path but removes a layer of defense-in-depth that browsers rely on to block client-side attack chains. CVSS assigns a low score of 3.7 with high attack complexity, reflecting that meaningful impact requires chaining this weakness with a secondary technique; no public exploit has been identified and the vulnerability is not listed in CISA KEV.
Missing HTTP security headers in the Gardyn admin panel expose Gardyn Home Firmware, Gardyn Studio Firmware, and Gardyn Cloud API to clickjacking and cross-site scripting attacks against authenticated administrators. The absence of directives such as X-Frame-Options, Content-Security-Policy frame-ancestors, and script-source restrictions allows an attacker to embed the admin panel in a malicious iframe or inject client-side scripts into the admin session context. Reported by ICS-CERT under advisory ICSA-26-183-03, no public exploit or active exploitation has been confirmed at time of analysis.
IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004 is vulnerable to HTTP header injection, caused by. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Host Header Injection in Password Manager (all versions per CPE) enables remote unauthenticated attackers to manipulate the HTTP Host header, causing the application to generate crafted links or responses that reference an attacker-controlled domain. Exploitation requires active user interaction (UI:A per CVSS 4.0 vector), limiting mass exploitation but enabling targeted phishing, password-reset link hijacking, or cache poisoning affecting dependent services. No public exploit code has been identified, and INCIBE has confirmed a vendor patch is available. This vulnerability is part of a broader set of issues disclosed simultaneously in the same INCIBE advisory.
HTTP header injection in IBM DevOps Plan 3.0.0 through 3.0.6 allows unauthenticated remote attackers to inject arbitrary HTTP headers by supplying a malicious HOST header value that the application fails to sanitize. The vulnerability (CWE-644) can be leveraged to mount cross-site scripting attacks against users, poison intermediate caches with attacker-controlled content, or hijack authenticated sessions. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the low-complexity, no-authentication-required attack surface makes this a meaningful risk for any internet-facing deployment.
HTTP header smuggling in @fastify/reply-from ≤12.6.1 and @fastify/http-proxy ≤11.4.3 allows remote unauthenticated attackers to strip proxy-added security headers from upstream requests via malicious Connection header values. Attackers can retroactively remove headers intended for routing, access control, or authentication, potentially bypassing proxy-enforced security policies. CVSS 9.0 (Critical) with high integrity impact to both vulnerable and subsequent systems. EPSS 0.04% indicates low mass-exploitation probability despite proof-of-concept availability (SSVC). Vendor patches available: upgrade to @fastify/reply-from ≥12.6.2 or @fastify/http-proxy ≥11.4.4.