CVE-2026-113728

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...

CVE-2026-113728 Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...

CVE-2026-113728 Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...

CVE-2026-113728 Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...

CVE-2026-113728

Versions of Bulwark Webmail prior to 1.9.2 are vulnerable to a DNS-rebinding SSRF in the public POST /api/fetch-ical endpoint. The root cause is a check-then-fetch pattern where the application performs one DNS lookup for validation and a second lookup for the socket connection; an attacker contr...

EUVD-2026-105773

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...

Malicious code in semvver (PyPI)

Source: amazon-inspector bbc16b0ced0bad1a33b912dfdb29cbaef211f30974d942991257d4e6b60a8ece setup.py performs an install-time fetch-and-execute: it calls urllib.request.urlretrieve against https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd, writes the response to a temporary path, and spawns it ...

Malicious code in semvver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbc16b0ced0bad1a33b912dfdb29cbaef211f30974d942991257d4e6b60a8ece setup.py performs an install-time fetch-and-execute: it calls urllib.request.urlretrieve against https://c2-worker.crawlnet-claim.workers.dev/dl/pyup...

MAL-2026-18104 Malicious code in semvver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbc16b0ced0bad1a33b912dfdb29cbaef211f30974d942991257d4e6b60a8ece setup.py performs an install-time fetch-and-execute: it calls urllib.request.urlretrieve against https://c2-worker.crawlnet-claim.workers.dev/dl/pyup...

ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

Summary The @apostrophecms/ai-helper package builds the URL for a server-side image fetch by resolving a storage-relative path against req.baseUrl. When the site does not set a global base URL the default, req.baseUrl is derived from the incoming HTTP Host header. An authenticated editor can...

GHSA-527G-FF96-X6WJ ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

Summary The @apostrophecms/ai-helper package builds the URL for a server-side image fetch by resolving a storage-relative path against req.baseUrl. When the site does not set a global base URL the default, req.baseUrl is derived from the incoming HTTP Host header. An authenticated editor can...

CVE-2026-113671 ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local...

CVE-2026-113671

In ApostropheCMS , a vulnerability exists in the @apostrophecms/ai-helper component (versions 1.0.0-beta.10 through 1.0.0-beta.13 ). An authenticated editor with image-generation capabilities can create a base64-generated image record without a provider URL. On deployments using local relative st...

CVE-2026-113671 ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local...

CVE-2026-113671 ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local...

Electron Cross-Site Request Forgery Vulnerability

Versions of Electron prior to 42.11.3, 43.0.0-alpha.1 through 43.7.0, 44.0.0-alpha.1 through 44.3.0, and 45.0.0-alpha.1 through 45.0.0-alpha.6 contain a cross-site request forgeing vulnerability. This vulnerability arises from treating a page that opens in a new window as a navigation request...

SvelteKit server-side request forgery vulnerability

Versions of SvelteKit prior to 3.0.0 contain a server-side request forgery vulnerability. This vulnerability arises from self-fetch fallback behavior that automatically follows HTTP redirects. Attackers can manipulate the Host or forwarded headers to redirect the fallback requests to their own...

RHLW-2026-5E3F8CCB11A37BA5 Lightwell Security Advisory: neethi 3.2.2.rhlw-00028

Red Hat Lightwell has released org.apache.neethi:neethi 3.2.2.rhlw-00028 with backported fixes for CVE-2026-91863, CVE-2026-91865, CVE-2026-91866, and CVE-2026-91867. CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service...

PT-2026-119043

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...

SUSE CVE-2026-109841

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...