CVE-2026-18694

creationtimestamp| type| source ---|---|--- 2026-08-13 04:45:19+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813...

CVE-2026-46382

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

UBUNTU-CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

PT-2026-71874

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

PT-2026-71580

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

PT-2026-71892

A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is...

Linux Distros Unpatched Vulnerability : CVE-2026-48551

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An...

PT-2026-71682

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions prior to 10.1.17 Description A weak cryptographic key generation issue exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, which lea...

PT-2026-71893

A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore url of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be...

PT-2026-71715

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by [email protected], which seeds an ARC4 strea...

PT-2026-71705

Name of the Vulnerable Software and Affected Versions CyberPanel versions prior to 3.0.0 Description The WebTerminal FastAPI SSH service contains a hard-coded JSON Web Token JWT secret. This allows unauthenticated remote attackers to forge valid authentication tokens by signing them with the...

SUSE SLES15 Security Update : erlang26 (SUSE-SU-2026:3579-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3579-1 advisory. - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. - CVE-2026-42789: publickey application...

CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

EUVD-2026-57701

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

CVE-2026-73423

Astro (web framework) vulnerability CVE-2026-73423 affects the composable astro/hono pipeline from versions 7.0.0–7.0.6. If actions() or pages() are mounted before middleware(), or if middleware() is omitted, security.checkOrigin is not enforced at dispatch sinks, allowing blind write‑only CSRF a...

CVE-2026-73423 Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware primitive, while actions and pages can dispatch to user code independently. Mounting actions before middleware, as in the...

CVE-2026-73307

Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows.ts. A builder with the AI...

CVE-2026-18952

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint...