https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 02:13:16 +0000 https://vulnerability.circl.lu/vuln/brew-jupyterlab-cve-2026-35536 <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p>Values passed to the `domain`, `path`, and `samesite` arguments of `RequestHandler.set_cookie` were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.</p> <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p>Values passed to the `domain`, `path`, and `samesite` arguments of `RequestHandler.set_cookie` were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.</p> https://vulnerability.circl.lu/vuln/brew-jupyterlab-cve-2026-35536 https://vulnerability.circl.lu/vuln/cve-2026-35536 <p><strong>Affected:</strong> tornadoweb Tornado</p> <p>In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.</p> <p><strong>Affected:</strong> tornadoweb Tornado</p> <p>In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.</p> https://vulnerability.circl.lu/vuln/cve-2026-35536 https://vulnerability.circl.lu/vuln/ghsa-78cv-mqj4-43f7 <p><strong>Affected:</strong> PyPI: tornado</p> <p>Values passed to the `domain`, `path`, and `samesite` arguments of `RequestHandler.set_cookie` were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.</p> <p><strong>Affected:</strong> PyPI: tornado</p> <p>Values passed to the `domain`, `path`, and `samesite` arguments of `RequestHandler.set_cookie` were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.</p> https://vulnerability.circl.lu/vuln/ghsa-78cv-mqj4-43f7