CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL...

CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL...

CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL...

CVE-2026-94483

The Next.js React framework (versions 16.0.0 through 16.3.8 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the Image Optimization component. The root cause is that the framework can follow attacker-controlled DNS resolution for remote URLs that match images.remotePatterns. T...

axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings

A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...

axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings

A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...

Linux Distros Unpatched Vulnerability : CVE-2026-94483

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolutio...

CVE-2026-94483: Server-Side Request Forgery (SSRF)

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2021_3155)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20213155 advisory. Mozilla: Uninitialized memory in a canvas object could have led to memory corruption CVE-2021-29980 Mozilla: Incorrect instruction reordering during JIT...

rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure

A flaw was found in rsync. This vulnerability allows a remote attacker to bypass hostname-based access control rules. By inducing DNS resolution failures, the rsync daemon incorrectly skips deny rules, granting unauthorized access to restricted module file trees...

Server-side Request Forgery (SSRF)

Overview next is a react framework. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Image Optimization remote fetch, which resolves and requests an allowlisted remote URL without constraining the address that name resolves to, so a host permitted by...

EUVD-2026-65088

jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution SSRF still present in InetAddress deserialization...

GHSA-VVGP-RFG2-7RR6 jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization

Summary CVE-2026-54514 GHSA-hgj6-7826-r7m5 fixed an eager-DNS-resolution / SSRF issue in jackson-databind's deserialization of java.net.InetSocketAddress by switching to InetSocketAddress.createUnresolved... PR 5951, commit 1f5a1037, released in 2.18.8 / 2.21.4 / 3.1.4. That fix did not cover the...

jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization

Summary CVE-2026-54514 GHSA-hgj6-7826-r7m5 fixed an eager-DNS-resolution / SSRF issue in jackson-databind's deserialization of java.net.InetSocketAddress by switching to InetSocketAddress.createUnresolved... PR 5951, commit 1f5a1037, released in 2.18.8 / 2.21.4 / 3.1.4. That fix did not cover the...

CVE-2026-101898

A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...

CVE-2026-55096

fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the sendmessage/sendmessagetophone MCP tools accept files as a list of https URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by validateurlsecurity, an SSRF denylist that check...

CVE-2026-55096 SSRF via DNS-resolution gap in _validate_url_security (file download by URL)

fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the sendmessage/sendmessagetophone MCP tools accept files as a list of https URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by validateurlsecurity, an SSRF denylist that check...

EUVD-2026-88377

fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the sendmessage/sendmessagetophone MCP tools accept files as a list of https URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by validateurlsecurity, an SSRF denylist that check...

CVE-2026-55096

The fast-mcp-telegram Telegram MCP Server is vulnerable to a Server-Side Request Forgery (SSRF) in versions prior to 30.1 . The send_message and send_message_to_phone tools allow users to provide HTTP(S) URLs for file downloads. The vulnerability exists because the _validate_url_security function...

CVE-2026-55096 SSRF via DNS-resolution gap in _validate_url_security (file download by URL)

fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the sendmessage/sendmessagetophone MCP tools accept files as a list of https URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by validateurlsecurity, an SSRF denylist that check...