Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the WebFetchTool.Execute function in the Guarded Web Fetch Flow process. An attacker can make the server initiate arbitrary HTTP requests to internal or external resources by supplying crafted URLs...

CVE-2026-56309: Allocation of Resources Without Limits or Throttling

Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readable R2 objects. Attackers can upload arbitrary attachments using upload-scoped API keys that bypass plan checks, persist outside normal bund...

ROS-20260710-73-0008

The vulnerability of the Go programming language is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service failures...

ROS-20260710-73-0019

The vulnerability of the Go programming language component tar Reader is related to unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

ROS-20260710-73-0032

The vulnerability of the Go programming language is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a perpetrator to cause service failures...

The vulnerability of the DefaultHttp2FrameReader class in the framework for developing network applications, servers, and clients using the Netty protocol allows a attacker to cause a service failure.

The vulnerability of the DefaultHttp2FrameReader class in the network application development framework for protocols like Netty relates to the distribution of resources without any restrictions or regulation. Exploiting this vulnerability can allow a malicious actor to cause service failures...

ROS-20260710-73-0027

The vulnerability of the Go programming language is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability of the TCPConnector HTTP-client library aiohttp, which allows a hacker to trigger a service failure.

The vulnerability of the TCPConnector HTTP-client library from aiohttp is related to the distribution of resources without any restrictions or regulations. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Langflow < 1.9.0 Missing Authorization (CVE-2026-33760)

The version of Langflow installed on the remote host is prior to 1.9.0. It is, therefore, affected by a missing authorization vulnerability: - The /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources without verifying that the...

CVE-2026-57054

A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable. If an MX Series device is...

CVE-2026-57054 Junos OS: MX Series: Web filtering doesn't block specifically formatted URLs

A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable. If an MX Series device is...

CVE-2026-57054

A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable. If an MX Series device is...

CVE-2026-57054

CVE-2026-57054 describes a Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series. The issue allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreacha...

USN-8523-1 libsoup2.4 vulnerabilities

Eric Su and Samuel Dainard discovered that libsoup incorrectly handled content with zero-length resources. An attacker could possibly use this issue to trigger a buffer over-read, resulting in information disclosure or a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the compile function. An attacker can cause excessive memory consumption by supplying a large comma-separated selector list, leading to process termination or degraded system...

CVE-2026-31984

A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into...

EUVD-2026-42512

The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated media-proxying endpoint, allowing anonymous users to make the site fetch arbitrary URLs, including internal and private-network addresses, and read back...

PT-2026-56987

Name of the Vulnerable Software and Affected Versions Junos OS on MX Series versions prior to 23.2R2-S7 Junos OS on MX Series versions 23.4 through 23.4R2-S8 Junos OS on MX Series versions 24.2 through 24.2R2-S5 Junos OS on MX Series versions 24.4 through 24.4R2-S4 Junos OS on MX Series versions...

Open Redirect

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Open Redirect via the filefetch function in the /gradioapi/file= endpoint. An attacker can redirect users to arbitrary URLs or access internal...

CVE-2026-60105 Monsta FTP < 2.14.5 SSRF via IPv4-Mapped IPv6 Address Bypass

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obta...