EUVD-2026-79311

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Portlet Services. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-73953

Oracle WebCenter Portal (a component of Oracle Fusion Middleware) is affected via its Portlet Services component. An unauthenticated attacker with network access via HTTP can exploit this vulnerability to achieve takeover of the portal. Supported affected versions are 12.2.1.4.0 and 14.1.2.0.0 . ...

EUVD-2026-79307

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Portlet Services. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-73952

CVE-2026-73952 affects the Portlet Services component of Oracle WebCenter Portal (Oracle Fusion Middleware), versions 12.2.1.4.0 and 14.1.2.0.0 . An unauthenticated attacker with network access via HTTP can exploit this with low complexity to achieve unauthorized creation, deletion, modification,...

EUVD-2026-79305

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Portlet Services. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-73951

Oracle WebCenter Portal (component: Portlet Services ) is affected by a vulnerability in supported versions 12.2.1.4.0 and 14.1.2.0.0 . The flaw allows an unauthenticated attacker with network access via HTTP to achieve takeover of the portal, with high impact to confidentiality, integrity, and a...

EUVD-2026-79306

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Portlet Services. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

EUVD-2026-79303

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Portlet Services. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-73949

A vulnerability in the Portlet Services component of Oracle WebCenter Portal (part of Oracle Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.0.0 . A low-privileged attacker with network access via HTTP can exploit this vulnerability without user interaction to achieve full tak...

CVE-2026-18424 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A...

CVE-2026-76693 Unauthenticated Denial-of-Service Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways

A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service against certain services running on impacted Gateways...

CVE-2026-11927

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-11927 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-11927

The IBM Security Verify Identity Access reverse proxy is vulnerable to a flaw where parameters can be injected into requests sent to third-party services. This issue is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') . Th...

EUVD-2026-78892

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-11927 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-54549

meta-ads-mcp (a Model Context Protocol server for Meta Ads) contains a Server-Side Request Forgery (SSRF) in the upload_ad_image tool. Prior to v1.0.115 , an attacker-controlled image_url parameter is passed to httpx.AsyncClient with follow_redirects=True and no scheme, host, or IP validation , e...

CVE-2026-58196 ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol MCP servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote/handler.go invokes discovery.DetectAuthenticationFromServer in pkg/auth/discovery/discovery.go, whose host-side HTTP...

CVE-2026-91943 Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where getpdfpath re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access...

CVE-2026-91943 Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where getpdfpath re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access...