22166 matches found
CVE-2026-55060 GoCD is vulnerable to authorization bypass via support process list API
GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/processlist endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line...
Reliance on Untrusted Inputs in a Security Decision
Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the Nexus callback routing logic in chasm/lib/callback/request.go and components/callbacks/request.go. An attacker can make the History service send a state-changing internal...
EUVD-2026-83913
MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify...
CVE-2026-94401
MISP versions below 2.5.47 contain an arbitrary local file read and SSRF vulnerability in the XML export/import upload functionality. The root cause is insufficient validation: MISP failed to verify that the uploaded content was actually XML, allowing an authenticated user with modify permissions...
CVE-2026-94401 MISP Arbitrary Local File Read and SSRF via MISP Export Upload
MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify...
CVE-2026-87858 Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...
CVE-2026-87858
Temporal Server is vulnerable in its Workflow completion callback delivery logic (both HSM and CHASM implementations). A caller with only write permission in a single namespace can attach a callback with a non-empty source header, causing the History service to re-target the request to the intern...
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...
PT-2026-96161
Name of the Vulnerable Software and Affected Versions Tinyauth versions prior to 5.1.2 Description Tinyauth performs case-sensitive comparisons of forwarded hostnames, whereas reverse proxies typically route equivalent hostnames case-insensitively. This discrepancy allows an authenticated user wi...
CVE-2026-63416: Improper Limitation of a Pathname to a Restricted Directory
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo to build a proxyPath and appends it directly to EXPORTURL without rejecting dot segments or confirming that the normalize...
CVE-2026-88403
A Server-Side Request Forgery (SSRF) vulnerability exists in the serverRequest function of nocobase v2.1.21 . This flaw allows authenticated attackers to perform internal resource scanning by sending a crafted HTTP request . No specific remediation, exploit links, or MITRE ATT&CK IDs are provided...
CVE-2026-61681: Server-Side Request Forgery (SSRF)
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get on payload.UnsubscribeURL after VerifyPayload even though BuildSignature...
PT-2026-96265
Name of the Vulnerable Software and Affected Versions NocoBase version 2.1.21 Description A Server-Side Request Forgery SSRF exists in the serverRequest function. This allows authenticated attackers to scan internal resources by sending a specially crafted HTTP request. SSRF is a flaw that allows...
CVE-2026-88403
A Server-Side Request Forgery SSRF in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request...
PT-2026-96299
Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.2 Description An authenticated user capable of creating or testing API connections can exploit a DNS rebinding condition. This occurs because the validateOutboundUrl function in server/modules/safeRequest.js...
PT-2026-96302
Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.3 Description Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls the applySqlVariables function from server/sources/shared/sql/sql.variables.js without enabling the...
Embedded Assessments for Frontier AI
Third-party evaluations for frontier AI have mostly tested models through external interfaces before deployment. But the risks from frontier AI models depend on how their developers use and govern them internally. Recently, CEOs of frontier AI companies have committed to hosting embedded...
PT-2026-96106
MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify...
PT-2026-96158
Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.2.7 Description Deployments with ENABLE DRAWIO PROXY=1 are susceptible to server-side request forgery. This occurs because the Utils.sanitizeUrl function in src/main/java/com/mxgraph/online/Utils.java performs a...
