Http4s: Set-Cookie rendering does not escape attribute delimiters

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated input can therefore emit injected cookie attributes such as Domain, Path, or SameSite, widening cookie scope or weakening protections, and control characters may enable header splitting on permissive backends. The patch strips control characters from all five fields and strips semicolons from name, content, domain, and path while retaining the extension delimiter behavior. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server contacted through the same CookieJar can plant a cookie for another domain, and the jar later sends that cookie to the victim domain, enabling session fixation or overwriting security-sensitive cookies. The patch validates the Set-Cookie domain against the response origin, although public-suffix rejection remains unimplemented. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

OmniPEMF NeoRhythm BLE missing authentication

A security vulnerability has been detected in OmniPEMF NeoRhythm up to 20260308. This affects an unknown function of the component BLE Interface. Such manipulation leads to missing authentication. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Microsoft Graphics Component Elevation of Privilege Vulnerability

Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Microsoft Azure CLI Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Azure CLI allows an authorized attacker to execute code over a network.

Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability

Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows an unauthorized attacker to elevate privileges with a physical attack.

Windows URL Moniker Security Feature Bypass Vulnerability

Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network.

Windows Biometric Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

Windows Biometric Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

n8n before 1.123.73 Remote Code Execution via Git Node

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with local configuration setting one of those keys together with a matching attribute pattern causes git to execute the configured command during an ordinary Add, Commit, Checkout, or Pull operation. The command runs as the n8n process user.

n8n before 1.123.73 Credential Exposure via Error Logging

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.

Win32k Information Disclosure Vulnerability

Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally.

Windows DNS Server Remote Code Execution Vulnerability

Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.

Windows Credential Providers Elevation of Privilege Vulnerability

Use after free in Windows Credential Providers allows an authorized attacker to elevate privileges locally.

Windows Accounts Control Elevation of Privilege Vulnerability

Use after free in Windows Accounts Control allows an authorized attacker to elevate privileges locally.

n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present, allowing attackers to bypass validation by supplying a safe uri alongside a malicious url to access internal addresses.

Windows Bluetooth Port Driver Elevation of Privilege Vulnerability

Use after free in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.

Windows Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.