CVE-2026-18487: User Interface (UI) Misrepresentation of Critical Information

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...

PT-2026-68770

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.1 Statamic versions prior to 6.24.0 Description When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker can sign in as an existing user, includin...

EulerOS 2.0 SP15 : mutt (EulerOS-SA-2026-2898)

According to the versions of the mutt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : mutt before 2.3.2 sometimes truncates the hashpasswd by one byte for IMAP authcram MD5 digest.CVE-2026-43860 mutt before 2.3.2 has an infinite loop ...

CVE-2026-64664: Exposure of Sensitive Information to an Unauthorized Actor

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

WP < 7.0.3 - Unauthenticated Blind SSRF

Description WordPress does not block requests to all reserved and internal IP address ranges, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services a blind Server-Side Request Forgery...

Linux Distros Unpatched Vulnerability : CVE-2026-71212

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xidown a yt-dlp/ffmpeg GUI wrapper builds its yt-dlp command-line invocation xidown/core/scanner.py and downloader.py by appending the user-provided or scanned...

EulerOS 2.0 SP15 : golang (EulerOS-SA-2026-2885)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a meta tag's content attribute. If the URL content were to...

EulerOS 2.0 SP15 : golang (EulerOS-SA-2026-2926)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a meta tag's content attribute. If the URL content were to...

CVE-2026-66881

Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path. A .livemd notebook can declare fileentries metadata, each entry carrying a name. Every path that creates a file entry through...

CVE-2026-66881 Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download

Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path. A .livemd notebook can declare fileentries metadata, each entry carrying a name. Every path that creates a file entry through...

JLSEC-2026-1165 Deno: WebSocket API sandbox bypass via missing post-DNS check

Summary When a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a...

CVE-2026-9081

IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery SSRF vulnerability in the validatemodelproviderkey function for the Ollama provider. The function accepts a user-supplied OLLAMABASEURL parameter and passes it directly to requests.get without...

CVE-2026-70443

The Jenkins Horreum Plugin version 0.16.162.v33b_4a_a_b_5f828 and earlier is vulnerable to a credentials exposure issue. The plugin fails to set the correct context during credentials lookup, which allows users with Item/Configure permissions to trigger Jenkins to send System-scoped credentials t...

CVE-2026-9081 Langflow OSS is affected by server-side request forgery in provider validation and API request functionality

IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery SSRF vulnerability in the validatemodelproviderkey function for the Ollama provider. The function accepts a user-supplied OLLAMABASEURL parameter and passes it directly to requests.get without...

Malicious code in test-dev-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44b80ff2bcf35e5c92c1c8a551b943d334f94793d693ce846707986613db8108 src/config.js hardcodes a remote host as the English-word phrase "Four Five P Nine Five P One Eight Six P Two Three Seven" and decodes it at import...

SSRF (Server-Side Request Forgery) ip-address Dependency in Jira Service Management Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 11.2.0 and 11.3.0 of Jira Service Management Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.7 and a CVSS Vector of...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

SSRF (Server-Side Request Forgery) ip-address Dependency in Jira Software Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 11.2.0 and 11.3.0 of Jira Software Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.7 and a CVSS Vector of...

CVE-2026-17617

IBM Application Gateway Operator (versions 22.2–26.06) is affected by a Server-Side Request Forgery (SSRF) due to insufficient validation of URLs in custom resources. The issue is documented across multiple sources (NVD entry and IBM security bulletin), with the IBM bulletin listing CVSS v3.1 bas...

CVE-2026-17617 Server-Side Request Forgery (SSRF) in IBM Application Gateway Operator

IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...