GHSA-3GQM-FCW5-W839 NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

There is an SSRF vulnerability in NLTK 3.9.4's network URL validation. The validatenetworkurl function in nltk/pathsec.py fails open when DNS resolution returns an error. The resolvehostname helper at lines 193-234 catches OSError and ValueError during socket.getaddrinfo and returns an empty list...

NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

There is an SSRF vulnerability in NLTK 3.9.4's network URL validation. The validatenetworkurl function in nltk/pathsec.py fails open when DNS resolution returns an error. The resolvehostname helper at lines 193-234 catches OSError and ValueError during socket.getaddrinfo and returns an empty list...

Security update for c-ares (important)

openSUSE security update: security update for c-ares ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21721-1 Rating: important References: bsc1270416 bsc1276290 bsc1276291 Cross-References: CVE-2026-33630 CVE-2026-69184 CVE-2026-69186 CVSS scores:...

CVE-2026-77310

A flaw was found in jackson-databind. A remote attacker can exploit this vulnerability by providing specially crafted input during data deserialization, specifically when java.net.InetAddress objects are processed. This causes the application to perform eager DNS resolution on attacker-controlled...

PT-2026-84020

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.70 Description URL uploads in php/elFinder.class.php can bypass server-side request forgery SSRF protections when PHP cURL is unavailable. The validate address function validates the IP address, but get remote...

Linux Distros Unpatched Vulnerability : CVE-2026-77310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1,...

Unity Linux 20.1070e Security Update: unbound (UTSA-2026-035860)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-035860 advisory. NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance...

CVE-2026-59278 In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the...

CVE-2026-59278 In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the...

CVE-2026-59278

Spring for Apache Kafka is vulnerable to SSRF via DNS resolution in its JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper classes. Because java.net is included in the default trusted packages list, an external Kafka producer can inject a java.net.InetAddress type through the spring_json_header_t...

CVE-2026-59278 In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the...

PT-2026-82434

Name of the Vulnerable Software and Affected Versions resolv gem versions prior to 0.7.2 Description An issue exists when decoding DNS responses where the functions Resolv::DNS::Resource.get class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new cla...

SUSE-SU-2026:23349-1 Security update for unbound

This update for unbound fixes the following issues: Update to version 1.25.2. Security issues fixed: - CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency bsc1271879. - CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget...

CVE-2026-47843: Undefined Security Weakness

In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

Server-side Request Forgery (SSRF)

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

Server-side Request Forgery (SSRF)

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

GHSA-X44H-65QV-CW74 praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

Summary praisonaiagents/tools/spidertools.py contains an SSRF protection bypass. The function hostisblocked validates URLs against a list of blocked IP literals and hostname aliases, but never performs DNS resolution. Any hostname that resolves to a private or loopback IP address — including publ...

praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

Summary praisonaiagents/tools/spidertools.py contains an SSRF protection bypass. The function hostisblocked validates URLs against a list of blocked IP literals and hostname aliases, but never performs DNS resolution. Any hostname that resolves to a private or loopback IP address — including publ...

CVE-2026-55526 PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spidertools.hostisblocked does not resolve ordinary hostnames before scrapepage fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permitting internal HTTP access. The fix uses...

CVE-2026-55526 PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spidertools.hostisblocked does not resolve ordinary hostnames before scrapepage fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permitting internal HTTP access. The fix uses...