Linux kernel af_unix DoS

The vulnerability of the afunix component in the Linux operating system kernel is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause service failures...

Linux Ethernet Network Adapter Driver Heap Buffer Overflow DoS

The vulnerability of the hclgevfknicsetup function in the drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevfmain.c file of the Linux kernel’s Ethernet network adapter driver is related to the lack of resource initialization. Exploiting this vulnerability could allow an attacker to cause a system...

ROS-20260708-73-0028

The vulnerability of the Grafana monitoring and observation platform’s plugin is related to the unlimited distribution of resources when processing requests to the endpoint. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

ROS-20260708-73-0026

The vulnerability of the Grafana Live messaging system in real-time mode, a platform for monitoring and surveillance, is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause service interruptions by sending specially crafted...

CVE-2026-59873: Allocation of Resources Without Limits or Throttling

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk spac...

CVE-2026-55575: Allocation of Resources Without Limits or Throttling

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filter at src/filters/array.ts allocated a full clone of its input array via ...toArrayv without calling this.context.memoryLimit.use..., allowing a template render such as hugearra...

ImageMagick SVG DoS

The vulnerability of the SVG file analysis function in the console-based graphic editor ImageMagick is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Server-side Request Forgery (SSRF)

Overview weblate is an A web-based continuous localization system with tight version control integration Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the URL validation. An attacker can access internal network resources by submitting specially crafted UR...

CVE-2026-57172 DataEase: Hardcoded JWT Signing Secret in ShareLink

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowing an attacker who can obtain a passwordless share for a resource and user to use the known key link-pwd-fit2cloud to forge linkToken JWTs,...

EUVD-2026-42093

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowing an attacker who can obtain a passwordless share for a resource and user to use the known key link-pwd-fit2cloud to forge linkToken JWTs,...

CVE-2026-58468

NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin...

GO-2026-5380 Hugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo

Hugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo...

PYSEC-2026-2034 WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect

Summary A Server-Side Request Forgery SSRF Protection Bypass exists in WeasyPrint's defaulturlfetcher. The vulnerability allows attackers to access internal network resources such as localhost services or cloud metadata endpoints even when a developer has implemented a custom urlfetcher to block...

WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect

SummaryA Server-Side Request Forgery SSRF Protection Bypass exists in WeasyPrint's defaulturlfetcher. The vulnerability allows attackers to access internal network resources such as localhost services or cloud metadata endpoints even when a developer has implemented a custom urlfetcher to block...

PYSEC-2026-1522 Langflow vulnerable to Server-Side Request Forgery

Vulnerability Overview Langflow provides an API Request component that can issue arbitrary HTTP requests within a flow. This component takes a user-supplied URL, performs only normalization and basic format checks, and then sends the request using a server-side httpx client. It does not block...

Langflow vulnerable to Server-Side Request Forgery

Vulnerability OverviewLangflow provides an API Request component that can issue arbitrary HTTP requests within a flow. This component takes a user-supplied URL, performs only normalization and basic format checks, and then sends the request using a server-side httpx client. It does not block...

nautobot-chatops (1.3.0), nautobot-device-resources (1.0.0) +3 more potentially affected by CVE-2025-49143 via nautobot (>=2.0.0, <=2.4.5)

nautobot PYPI version =2.0.0, =2.0.0, =2.0.0, =2.5.0 - nautobot-ssot-unifi 1.0.2 Source cves: CVE-2025-49143 Source advisory: OSV:PYSEC-2026-1689...

CVE-2026-12352

This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device...

FastChat Server-Side Request Forgery vulnerability

A Server-Side Request Forgery SSRF vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials...

PYSEC-2026-1408 gradio Server Side Request Forgery vulnerability

In gradio =4.42.0, the gr.DownloadButton function has a hidden server-side request forgery SSRF vulnerability. The reason is that within the saveurltocache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resourc...