https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T20:55:48.573513+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-269947 EUVD-2026-269947 2026-10-09T20:55:48.577361+00:00 EUVD-2026-269947 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26747 fkie_cve-2026-26747 2026-10-09T20:55:48.577393+00:00

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.force_url" is not set and default is "false". The application generates absolute URLs (such as those used in password reset emails) using the user-supplied Host header. This allows remote attackers to poison the password reset link sent to a victim,

 https://cve.radiocsirt.org/vuln/ghsa-xf4f-qj26-72pf GHSA-xf4f-qj26-72pf 2026-10-09T20:55:48.577434+00:00

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.force_url" is not set and default is "false". The application generates absolute URLs (such as those used in password reset emails) using the user-supplied Host header. This allows remote attackers to poison the password reset link sent to a victim,