CVE-2026-91923 KubeSphere through 4.1.3 SSRF via git credential verification endpoint

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate...

postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments

A type confusion vulnerability in PostgreSQL allows any user to execute arbitrary code as the database's operating system user by calling functions with mishandled "internal" data type arguments...

CVE-2026-91750 WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...

EUVD-2026-78232

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...

CVE-2026-91750

WeKnora before 0.7.0 (developed by Tencent) is vulnerable to SSRF via unvalidated HTTP redirects. The flaw resides in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint, which fails to re-validate redirect targets after the initial SSRF check when downloading documents from user-supplied...

CVE-2026-91750 WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...

PT-2026-92643

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle User Management versions 12.2.6 through 12.2.15 Description A flaw in the Internal Operations component of the Oracle User Management product allows a low privileged attacker with network access via HTTP to...

PT-2026-92086

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1 Description A blind server-side request forgery exists in the getHeaderContentTypeFromURL function, which performs get headers calls that are only protected by format validation. Authenticated users with canUpload...

PT-2026-92921

Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

PT-2026-92939

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle US Federal Human Resources versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle US Federal Human Resources product. A low privileged attacker with network...

PT-2026-92727

Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sourcing. Successful...

PT-2026-92613

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Alert versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component of Oracle Alert allows a low privileged attacker with network access via HTTP to compromise the system. Successful...

PT-2026-92635

Name of the Vulnerable Software and Affected Versions Oracle Partner Management versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. This issue can lead to unauthorized acces...

CVE-2026-79425

CRMEB v6.0.0 is affected by an authenticated Server-Side Request Forgery (SSRF) vulnerability in the /adminapi/file/online_upload component. This flaw allows an authenticated attacker to scan internal resources by sending a crafted POST request . While exploitation details are not explicitly prov...

PT-2026-92665

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Proposals versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component of Oracle Proposals allows a low privileged attacker with network access via HTTP to compromise the system. This...

PT-2026-92978

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub...

EUVD-2026-78625

An authenticated Server-Side Request Forgery SSRF in the /adminapi/file/onlineupload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request...

PT-2026-92663

Name of the Vulnerable Software and Affected Versions Oracle Field Service of Oracle E-Business Suite versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Field Service product. A low privileged attacker with network access via HTTP can...

PT-2026-92616

Name of the Vulnerable Software and Affected Versions Oracle Field Service versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthoriz...

PT-2026-92919

Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...