39555 matches found
SUSE CVE-2026-42592
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, FilterOutboundURL resolves the hostname, checks the resolved IPs against the private-address deny-list, and returns only the error. It discards the resolved addresses. Chromium later performs its own DNS resolution when i...
SUSE CVE-2026-44015
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery SSRF by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwar...
SUSE CVE-2026-47190
IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions create, delete, get, list, patch, update, watch on core/v1 Secrets. The controller never accesses Secrets during normal...
SUSE CVE-2026-53520
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing. This issue has been patched in version 2.1.0...
SUSE CVE-2026-54272
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType classifies an address by matching it against a table of known IPv6...
MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
Summary MessagePack::Bufferclear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor rmemlast, rmemend, rmemowner. The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has...
CVE-2026-54722 dssrf: there a critical security bug with remove_at_symbol_in_string
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
CVE-2026-67346
Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the issafeurl function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve ...
EUVD-2026-50465
Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation...
CVE-2026-67345
MaxKey before 4.1.12 contains an insufficient redirect URI validation in DefaultRedirectResolver.hostMatches(), allowing remote attackers to hijack OAuth 2.0 authorization codes via a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attack...
CVE-2026-67345 MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft
MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirecturi whose hostname suffix matches a registered...
EUVD-2026-51148
MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirecturi whose hostname suffix matches a registered...
CVE-2026-18378
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...
CVE-2026-18381 Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...
CVE-2026-18381
The CVE-2026-18381 affects the koku-metrics-operator used with Red Hat OpenShift. A flaw in the CostManagementMetricsConfig custom resource lets an authorized user edit the CR to specify an arbitrary upload URL. The operator then attaches its Kubernetes service-account bearer token to queries sen...
CVE-2026-18381
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...
CVE-2026-18381
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...
CVE-2026-18369
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...
CVE-2026-18369
Dogtag PKI’s ACME responder is vulnerable: the HTTP-01 validator accepts IP literal identifiers and follows redirects without validating public-facing targets, enabling unauthenticated ACME accounts to induce SSRF to internal services. With the InMemory database backend, the internal target respo...
