CVE-2026-82247 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing

gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...

CVE-2026-82246 Budibase Server before 3.41.3 SSRF via Query Import

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...

CVE-2026-82246 Budibase Server before 3.41.3 SSRF via Query Import

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...

EUVD-2026-67698

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...

CVE-2026-82246

Budibase Server before 3.41.3 is affected by a server-side request forgery (SSRF) vulnerability in the query import endpoint . The root cause is the failure to validate user-supplied URLs before fetching content, allowing authenticated attackers to submit arbitrary URLs and retrieve responses fro...

CVE-2026-82246 Budibase Server before 3.41.3 SSRF via Query Import

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...

SUSE CVE-2024-29180

Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the...

CVE-2026-78615

A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...

SUSE CVE-2026-55677

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...

CVE-2026-54330

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

CVE-2026-37710

The software Omeka S (version 4.2.0 ) is vulnerable to a Cross-Site Scripting (XSS) flaw within the site navigation custom URL process. An attacker can inject malicious code that is executed in the context of a user's browser because the application fails to properly validate and escape input bef...

EUVD-2026-67774

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

CVE-2026-82247: Insufficiently Protected Credentials

gitoxide's gix-url crate = 0.32.0, fixed in 0.37.1 uses a hand-rolled URL parser that does not treat '?' or '' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard canreuseidentity compares the wrong host and fails open. An...

CVE-2026-51647: Improper Access Control

Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-37710

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

FreeBSD : PHP Composer -- Multiple vulnerabilities (db135cd1-a232-11f1-85ed-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the db135cd1-a232-11f1-85ed-10ffe07f9334 advisory. Composer project reports: Validate package bin paths against path traversal using symlinks...

openSUSE 16 Security Update : python-pip (openSUSE-SU-2026:21643-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21643-1 advisory. This update for python-pip fixes the following issue: - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows...

CVE-2026-37237

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read without enforcing a maximum response...

CVE-2026-50979

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

EUVD-2026-67767

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...