PT-2026-58717

Name of the Vulnerable Software and Affected Versions .NET Framework affected versions not specified Description An issue exists where resources are allocated without limits or throttling, allowing an unauthorized attacker to cause a denial of service over a network. Recommendations At the moment...

PT-2026-57945

SAP S/4HANA application Project Management PPM-PRO allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability of the application...

PT-2026-58361

Name of the Vulnerable Software and Affected Versions Windows Media affected versions not specified Description An issue exists in Windows Media where concurrent execution using a shared resource with improper synchronization, known as a race condition, allows an authorized attacker to elevate...

CVE-2026-48805: Protection Mechanism Failure

Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow, arraySome, and arrayEvery, allowing legacy calls such as twigarraysome, twigarrayevery, and twigcheckarrowinsandbox t...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through RemoteUrlAdapter in MediaUploader::fromSource. An attacker can make the server issue arbitrary HTTP requests and reach internal resources by supplying a caller-controlled remote URL. The vulnerab...

CVE-2026-14906 Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4...

CVE-2026-49969 Laravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL Handling

Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource. Attackers can craft URLs targeting...

PYSEC-2026-2678 OpenStack Neutron has an Incorrect Authorization issue

In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags...

OpenStack Neutron has an Incorrect Authorization issue

In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags...

pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider

ImpactA raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication. The issue manifests when pygeoapi is deployed without a proxy or web front end that would...

PYSEC-2026-2986 pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

Impact OGC API - Process execution requests can use the subscriber object to requests to internal HTTP services. Patches The issue has been patched in master branch and made available as part of the 0.23.3 release. The patch disables any HTTP requests made to internal resources by default unless...

Server-side Request Forgery (SSRF)

Overview misp-modules is a MISP modules are autonomous modules that can be used for expansion and other services in MISP Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the htmltomarkdown process. An attacker can access internal network resources by supplyi...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via unvalidated job template URI processing. An attacker can access internal network resources and cloud metadata endpoints by submitting crafted URIs through authenticated requests. Remediation Upgrade...

MINI-9284-WGRX-6W3X

Bulletin has no description...

PT-2026-59613

Impact OGC API - Process execution requests can use the subscriber object to requests to internal HTTP services. Patches The issue has been patched in master branch and made available as part of the 0.23.3 release. The patch disables any HTTP requests made to internal resources by default unless...

PT-2026-59261

Summary A Server-Side Request Forgery SSRF vulnerability exists in LMDeploy's vision-language module. The load image function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, a...

PT-2026-57839

Name of the Vulnerable Software and Affected Versions mcp-gitlab versions prior to 2.1.18 Description A path traversal issue exists in the job id parameter within the build/index.js file. This allows attackers to escape the intended path prefix by providing crafted values, such as ../../../user, ...

ROS-20260713-73-0017

The vulnerability is related to improper locking of resources. Exploiting this vulnerability can allow a attacker to cause a service failure...

PT-2026-59612

Impact A raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication. The issue manifests when pygeoapi is deployed without a proxy or web front end that would...

node-tar DoS

The vulnerability of the src/extract.ts file in the node-tar library of the Node.js software platform is related to unlimited resource distribution. Exploiting this vulnerability could allow a malicious actor to cause service failures...