156225 matches found
CVE-2026-38924
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a...
CVE-2026-38924
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a...
PT-2026-91459
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.2 Description An authenticated attacker can perform server-side request forgery SSRF, a flaw that allows the system to be coerced into making unauthorized requests. This can be used for network...
CVE-2026-12944: Server-Side Request Forgery (SSRF)
IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...
PT-2026-91640
A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access local network devices without user consent...
PT-2026-91710
A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in...
CVE-2026-12766: Server-Side Request Forgery (SSRF)
IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...
EUVD-2023-60633
PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor...
CVE-2023-22631
PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor...
CVE-2023-22631
PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor...
CVE-2023-22631: Improper Neutralization of Argument Delimiters in a Command
PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor...
PT-2026-91035
PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor...
CVE-2023-22632
PRTG Network Monitor (Paessler) before version 23.1.82 is affected by a vulnerability that allows remote attackers to write to files via the FTP Server Count Sensor . The attack requires high privileges (authenticated access) over the network, resulting in a low integrity impact (CVSS 3.1 score 2...
Debian dsa-6498 : network-manager-l2tp - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6498 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6498-1 [email protected] https://www.debian.org/securit...
Linux Distros Unpatched Vulnerability : CVE-2026-75131
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN...
CVE-2023-22632
PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor...
CVE-2026-54628: Improper Access Control
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as jsonreader and logreader through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can provi...
CVE-2026-12765: Server-Side Request Forgery (SSRF)
IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...
CVE-2026-90818: Server-Side Request Forgery (SSRF)
A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in...