EUVD-2026-71796

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

SUSE CVE-2026-78682

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen and callers nltk.data.load, nltk.downloader.Downloader.index/download when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables...

CVE-2026-86100

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

CVE-2026-86100: Server-Side Request Forgery (SSRF)

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

CVE-2026-86206: Incomplete Filtering of Special Elements

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...

CVE-2026-86207: Authentication Bypass by Primary Weakness

An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal only APIs...

CVE-2026-86123: Server-Side Request Forgery (SSRF)

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...

CVE-2026-86115: Unintended Proxy or Intermediary

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...

PT-2026-86386

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...

PT-2026-86447

Name of the Vulnerable Software and Affected Versions N-central versions prior to 2026.3 HF3 N-central versions prior to 2026.4 Description An issue in the internal API access control filter allows unauthorized access to internal APIs. Recommendations Update to version 2026.3 HF3. Update to versi...

PT-2026-86394

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...

PT-2026-86448

Name of the Vulnerable Software and Affected Versions N-central versions prior to 2026.3 HF 3 Description An authentication bypass exists that allows unauthorized access to internal only APIs. Recommendations Update N-central to version 2026.3 HF 3...

CVE-2026-86122: Server-Side Request Forgery (SSRF)

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network...

PT-2026-86393

Name of the Vulnerable Software and Affected Versions Rowboat versions prior to 0.9.2 Description Authenticated users can configure arbitrary destinations because the software fails to validate custom MCP server and webhook URLs. This allows attackers to point these URLs at internal services and...

CVE-2026-86100 Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

GHSA-RH53-XVX2-J327 OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

Summary The OpenChoreo control-plane cluster-gateway exposes internal management APIs /api/proxy/, /api/exec/, /api/wirelogs/ that tunnel requests through to connected data planes' Kubernetes APIs, but the internal listener authenticates no caller. Its request validator permits mutating HTTP...

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

Summary The OpenChoreo control-plane cluster-gateway exposes internal management APIs /api/proxy/, /api/exec/, /api/wirelogs/ that tunnel requests through to connected data planes' Kubernetes APIs, but the internal listener authenticates no caller. Its request validator permits mutating HTTP...

MINI-X3VQ-JW43-HR55

Bulletin has no description...

EUVD-2026-71721

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...

CVE-2026-63464 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...