https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T03:59:51.792456+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2016-00310 cnvd-2016-00310 2026-10-04T03:59:51.799342+00:00 cnvd-2016-00310 https://cve.radiocsirt.org/vuln/euvd-2026-95062 EUVD-2026-95062 2026-10-04T03:59:51.799377+00:00 EUVD-2026-95062 https://cve.radiocsirt.org/vuln/fkie_cve-2015-7519 fkie_cve-2015-7519 2026-10-04T03:59:51.799391+00:00

agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.

 https://cve.radiocsirt.org/vuln/ghsa-fxwv-953p-7qpf GHSA-fxwv-953p-7qpf — Phusion Passenger allows remote attackers to spoof headers 2026-10-04T03:59:51.799419+00:00

Affected: RubyGems: passenger

`agent/Core/Controller/SendRequest.cpp` in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an `_` (underscore) character instead of a `-` (dash) character in an HTTP header, as demonstrated by an `X_User` header.

 https://cve.radiocsirt.org/vuln/gsd-2015-7519 gsd-2015-7519 2026-10-04T03:59:51.799444+00:00 gsd-2015-7519 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11341-1 openSUSE-SU-2024:11341-1 — ruby2.7-rubygem-passenger-6.0.8-3.2 on GA media 2026-10-04T03:59:51.799455+00:00

ruby2.7-rubygem-passenger-6.0.8-3.2 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2015:2337-1 SUSE-SU-2015:2337-1 — Security update for rubygem-passenger 2026-10-04T03:59:51.799474+00:00

Security update for rubygem-passenger

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2015-7519 Withdrawn: UBUNTU-CVE-2015-7519 2026-10-04T03:59:51.799490+00:00

Withdrawn by the publisher.

Affected: Ubuntu:16.04:LTS: passenger

agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.