CVE-2026-57106

Server-side request forgery ssrf in Data Quality allows an unauthorized attacker to elevate privileges over a network...

SUSE-SU-2026:3245-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2026-7210: insufficient entropy used for Expat hash-flooding protection allows a crafted XML document to trigger hash flooding bsc1264962. - CVE-2026-8328: server-supplied PASV host address is trusted by ftpcp and allows for SSRF bsc126526...

CLSA-2026-1784899428 poppler: Fix of CVE-2025-43903

CVE-2025-43903: properly verify adbe.pkcs7.sha1 signatures in SignatureHandler::validateSignature to prevent signature forgeries...

ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link

Cybersecurity researchers have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence AI agent inside a victim's organization. The vulnerability has bee...

OESA-2026-3152 wget security update

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc. Security Fixes: GNU Wget does n...

PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes

...

WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin AffiliateX versions = 2.3.5...

CVE-2026-16910

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud...

CVE-2026-16910

CVE-2026-16910 describes an SSRF flaw in Red Hat Quay’s notification webhook handlers for Slack and generic webhooks. The handlers accept user-supplied URLs without SSRF validation, enabling a repository administrator to cause the Quay worker to issue POST requests to internal network addresses o...

CVE-2026-12688 ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made...

CVE-2026-12688

The ProfileGrid WordPress plugin (versions before 5.9.9.7 ) is vulnerable to an unauthenticated payment bypass . The software fails to properly verify PayPal IPN notifications , allowing an unauthenticated attacker to forge a payment notification. This flaw enables an attacker to mark any user as...

EUVD-2026-48489

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-11714 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3...

EUVD-2026-48451

Server-side request forgery ssrf in Azure AI Search allows an authorized attacker to elevate privileges over a network...

CVE-2026-56167

Server-side request forgery ssrf in Azure AI Search allows an authorized attacker to elevate privileges over a network...

EUVD-2026-48435

9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...

PT-2026-64314

Server-side request forgery ssrf in Data Quality allows an unauthorized attacker to elevate privileges over a network...

PT-2026-71715

Name of the Vulnerable Software and Affected Versions sm-crypto versions prior to 0.5.0 Description The software provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. In Node.js, the default no-argument sm2.generateKeyPairHex path uses a SecureRandom...

📄 SIP Sustainable Irrigation Platform 5.x Cross Site Request Forgery

SIP Sustainable Irrigation Platform version 5.x performs state-changing actions through HTTP GET requests without including any anti-CSRF token or validating the request origin. This can be exploited to perform administrative actions such as disabling the passphrase, rebooting the device, deletin...

SUSE SLES12 Security Update : wget (SUSE-SU-2026:3205-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3205-1 advisory. This update for wget fixes the following issues - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side reques...