https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 15:02:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336817 EUVD-2026-336817 https://cve.radiocsirt.org/vuln/euvd-2026-336817 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43644 <p>podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go&#39;s content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker&#39;s page.</p> <p>podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go&#39;s content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker&#39;s page.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-43644 https://cve.radiocsirt.org/vuln/ghsa-q23m-vm9r-5745 <p><strong>Affected:</strong> Go: github.com/stefanprodan/podinfo</p> <p>podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go&#39;s content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker&#39;s page.</p> <p><strong>Affected:</strong> Go: github.com/stefanprodan/podinfo</p> <p>podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go&#39;s content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker&#39;s page.</p> https://cve.radiocsirt.org/vuln/ghsa-q23m-vm9r-5745