43746 matches found
CVE-2026-53446: Server-Side Request Forgery (SSRF)
Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan webhook integration URLs in models/integrations.js are stored from user input and later fetched by server/notifications/outgoing.js without applying the existing validateAttachmentUrl private-network checks from...
Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack
Microsoft shipped its largest Patch Tuesday on record today, and two of the fixes close holes that attackers are already exploiting. The release covers 622 of Microsoft's own CVEs by its Security Update Guide count, more than triple June's previous high of around 200. Those two live bugs are the...
CVE-2026-61520 Simple Machines Forum SSRF via image proxy
Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the pro...
CVE-2026-61520 Simple Machines Forum SSRF via image proxy
Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the pro...
EUVD-2026-44490
Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the pro...
CVE-2026-61520
The CVE-2026-61520 entry documents a server-side request forgery in Simple Machines Forum (SMF) image proxy. Affected versions are SMF 2.1 prior to commit 4bf35cf and SMF 3.0 prior to commit b4d23df. The vulnerability allows authenticated attackers to trigger internal HTTP requests by embedding a...
CVE-2026-61520 Simple Machines Forum SSRF via image proxy
Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the pro...
Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Axios
Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Axios. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-44486 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and...
EUVD-2026-44139
Improper authorization in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges over a network...
EUVD-2026-44134
Improper neutralization of input during web page generation 'cross-site scripting' in Active Directory Federation Services AD FS allows an authorized attacker to perform spoofing over a network...
EUVD-2026-44138
Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally...
EUVD-2026-44073
Stack-based buffer overflow in Active Directory Federation Services AD FS allows an unauthorized attacker to deny service over a network...
EUVD-2026-43866
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network...
EUVD-2026-43903
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network...
EUVD-2026-43941
Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network...
EUVD-2026-43936
Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally...
EUVD-2026-43906
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network...
EUVD-2026-43887
Loop with unreachable exit condition 'infinite loop' in Active Directory Federation Services AD FS allows an unauthorized attacker to deny service over a network...