BIT-KEYCLOAK-2026-7504 Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak

A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further...

CVE-2026-79659 Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata...

CVE-2026-79659

Ech0 before 4.7.3 is affected by a Server-Side Request Forgery (SSRF) vulnerability in the fetchPeerConnectInfo function. The root cause is the use of unvalidated HTTP requests instead of safe request methods with URL validation. An authenticated attacker can supply arbitrary URLs to reach intern...

EUVD-2026-65395

Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is...

CVE-2026-55976

Apache Hive versions before 4.2.1 are vulnerable to a Server-Side Request Forgery (SSRF) in the Avro SerDe schema resolution. Specifically, improper input validation of the avro.schema.url table property allows an authenticated remote attacker with CREATE TABLE privileges to force the Hive server...

CVE-2026-77137

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

CVE-2026-77137 SQL Injection in extension "Forms Export" (frp_form_answers)

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

EUVD-2026-65339

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

CVE-2026-77137

CVE-2026-77137 is a SQL injection vulnerability in the TYPO3 extension "Forms Export" (extension key: frp_form_answers ). The extension fails to properly sanitize user input before using it in a database query, allowing a low-privileged backend user to inject arbitrary SQL through a URL parameter...

CVE-2026-77137

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

CVE-2026-77137 SQL Injection in extension "Forms Export" (frp_form_answers)

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

CVE-2026-10582

A flaw was found in Hugo. The security.http.urls allowlist, which controls outbound fetches, does not adequately validate the destination address of URLs. This vulnerability allows a remote attacker to supply a specially crafted URL that resolves to internal network resources. As a result, the Hu...

MAL-2026-14483 Malicious code in modules-newline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c5565e7fd7984da26242b79340fb41f4f4595fdd5fbeb929ff5dfca5b13cc1a package.json declares the package's own name, modules-newline, as both a dependency and devDependency pointing to...

Malicious code in react-remove-properties (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba88629ecae2a180282c29fd385e0bb2067193f01bb3b482b550ae50765d246f package.json declares the package's own name in both dependencies and devDependencies pointing at http://pack.nppacks.com/npm/react-remove-properties...

MAL-2026-14487 Malicious code in spotify-url-resolovela (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93f6315c9b94537e8f2ba85260ccc147a6fdf9ab19336609d10e9819db575045 On require/import of the package's main index.js, a top-level startBackupLoop call runs immediately and reschedules every 60 minutes. It archives the...

Malicious code in spotify-url-resolovela (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93f6315c9b94537e8f2ba85260ccc147a6fdf9ab19336609d10e9819db575045 On require/import of the package's main index.js, a top-level startBackupLoop call runs immediately and reschedules every 60 minutes. It archives the...

MAL-2026-14473 Malicious code in css-import-order (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a190c01197be10bae5104dd08b8cb119ff1460eaa0c816bc0eb74da8a4b88ae4 package.json declares the package's own name css-import-order as both a dependency and devDependency pointing at...

SUSE-SU-2026:23319-1 Security update for python-pip

This update for python-pip fixes the following issue: - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to be installed to arbitrary locations on disk bsc1273090...

SUSE CVE-2026-10582

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

SUSE CVE-2026-15806

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also us...