CVE-2026-85650: Server-Side Request Forgery (SSRF)

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

PT-2026-85541

Douyin TikTok Download API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video data endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services includi...

PT-2026-85514

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TAC Information Services Internal and External Trade Inc. GOLDENHORN ONEIT allows Blind SQL Injection. This issue affects GOLDENHORN ONEIT: before Göbeklitepe...

PT-2026-85551

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.2 Description Authenticated users with organization membership can exploit a server-side request forgery SSRF issue. This occurs because webhook alert channel delivery URLs are fetched without proper validatio...

EUVD-2026-70578

Unauthenticated SQL Injection in VikAppointments Services Booking Calendar = 1.2.20 versions...

CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-85164

WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the setapiuserImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal...

CVE-2026-79679

Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit used in mapp Services: before 6.8.0...

CVE-2026-79679 Use of Weak Credentials

Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit used in mapp Services: before 6.8.0...

EUVD-2026-70412

Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit used in mapp Services: before 6.8.0...

CVE-2026-79679 Use of Weak Credentials

Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit used in mapp Services: before 6.8.0...

CVE-2026-79679

CVE-2026-79679 is a Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit as used in mapp Services, affecting versions before 6.8.0 . The weakness allows network-based exploitation with no privileges required. The CVSS 3.1 base score is 8.7 (HIGH) , with High impact o...

terminalphone — Updated!

TerminalPhone Encrypted push-to-talk voice communication over Tor hidden services. TerminalPhone is a single, self-contained Bash script that provides anonymous, end-to-end encrypted voice and text communication between two or more parties over the Tor network. It operates as a walkie-talkie: you...

[SECURITY] Fedora 44 Update: syncthing-2.1.3-1.fc44

Syncthing replaces other file synchronization services with something open, trustworthy and decentralized. Your data is your data alone and you deserve to choose where it is stored, if it is shared with some third party and how it's transmitted over the Internet. Using syncthing, that control is...

SUSE CVE-2026-28416

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery SSRF vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victim application uses...

PT-2026-85140

Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5...

CVE-2026-85012: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command CWE-78 in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execute arbitrary commands in the blueprint...

CVE-2026-85179: Server-Side Request Forgery (SSRF)

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-84768: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in VikAppointments Services Booking Calendar = 1.2.20 versions...