CVE-2026-85691: Server-Side Request Forgery (SSRF)

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...

PT-2026-85666

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL...

CVE-2026-76169: Authentication Bypass Using an Alternate Path or Channel

fastify versions = 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches...

Fedora 43 : composer (2026-0425df0537)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0425df0537 advisory. Version 2.10.3 - 2026-08-27 Security: Validate package bin paths against path traversal using symlinks GHSA-96h3-5x6v-m776, CVE-2026-59944 Security:...

PT-2026-86174

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser...

EUVD-2022-56031

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL...

PT-2026-85569

Name of the Vulnerable Software and Affected Versions Dub affected versions not specified Description An open redirect issue exists where the redir url query parameter is accepted on every short link without validation or domain allowlist enforcement. This allows attackers to append the redir url...

CVE-2026-19304: Server-Side Request Forgery (SSRF)

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy...

RockyLinux 9 : grafana-pcp (RLSA-2026:63136)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:63136 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial o...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

gitpython: GitPython: Information disclosure via environment variable expansion in URL handling

A flaw was found in GitPython. This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. When these URLs are processed during Git operations like fetch or pull, the environment variables are expanded and transmitted...

EUVD-2026-57321

Material for MkDocs: DOM XSS in search suggestions via query parameter...

NPM: Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

NPM: Orval: RCE via servers.url - unescaped request-URL template literal with getBaseUrlFromSpecification vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...

Security Bulletin: MongoDB Enterprised Advanced affected by: Open Redirect (CVE-2026-40181)

Summary There are vulnerabilities in router-1.23.2.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-40181. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-40181 DESCRIPTION: React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7...

EUVD-2026-70655

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49456

Waku (the minimal React framework) prior to version 1.0.0-beta.1 is vulnerable to an open redirect via the unstable_redirect() helper in waku/router/server. The function reflects user-supplied strings unchanged into the HTTP Location header with no URL validation, scheme restriction, or path-only...

CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

GHSA-4MVJ-M6J5-PMF7 unstructured: Server-Side Request Forgery in the URL-based partitioning

Summary Server-Side Request Forgery in unstructured. The url= argument of partition, partitionhtml, and partitionmd is fetched via requests.get with no host validation. The response body is returned as Element text, so this is a full-read SSRF — attackers reach loopback admin APIs, internal HTTP...