CVE-2026-18545

IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2026-18545

IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2026-82287

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

CVE-2026-55248 plone.app.portlets: Denial of service via RSS feed portlet

plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in...

EUVD-2026-42930

9router: Unauthenticated /v1 proxy access via Host-header spoofing → open AI relay + SSRF...

EUVD-2026-42931

9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass...

EUVD-2026-42989

Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancelbyadmin Parameter...

EUVD-2026-67799

Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers can reach the unauthenticated Gradio interface to make the server issue HTTP requests to...

CVE-2026-82263 Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private...

CVE-2026-82258

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests...

CVE-2026-82238

filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation...

EUVD-2026-67584

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests...

CVE-2026-82258

SvelteKit versions from 2.38.0 up to (but not including) 2.60.1 are affected by a race condition in the query.batch feature. Under specific timing conditions, concurrent requests from different users can merge under a single request context, allowing an attacker to access sensitive data from othe...

EUVD-2026-67690

filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation...

PT-2026-83369

Name of the Vulnerable Software and Affected Versions free5GC versions 1.4.4 and earlier Description The AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool within internal/context/context.go, using only the SUPI as a key. Requests processed by...

CVE-2026-54330 Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

CVE-2026-59324

When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...

CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...

CVE-2026-47892

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...

EUVD-2026-66831

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...