CVE-2026-59132

Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network...

EUVD-2026-56312

Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network...

Windows TCP/IP Remote Code Execution Vulnerability

Stack-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to execute code over a network...

Windows TCP/IP Denial of Service Vulnerability

Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network...

CVE-2026-72598

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

EUVD-2026-56108

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

CVE-2026-72598 Apioo Fusio - Server-Side Request Forgery

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

CVE-2026-72598

CVE-2026-72598 affects Apioo Fusio 8.8.3. A server‑side request forgery occurs when authenticated consumer‑role users register a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax with FILTER_VALIDATE_URL but imposes no IP or host denylist. When the r...

CVE-2026-72598

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

CVE-2026-72597 Friendica Friendica - Server-Side Request Forgery

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

SUSE CVE-2026-45045

Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add instead of Header.Set when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream serve...

PT-2026-70411

Name of the Vulnerable Software and Affected Versions Windows TCP/IP affected versions not specified Description A null pointer dereference in Windows TCP/IP allows an unauthorized attacker to cause a denial of service over a network. A null pointer dereference occurs when a program attempts to...

PT-2026-70202

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

CVE-2026-59132: NULL Pointer Dereference

Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network...

PT-2026-70542

Name of the Vulnerable Software and Affected Versions Windows TCP/IP affected versions not specified Description A stack-based buffer overflow in Windows TCP/IP allows an unauthorized remote attacker to execute arbitrary code over a network, potentially compromising the system. Recommendations At...

PT-2026-70142

Name of the Vulnerable Software and Affected Versions Apioo Fusio version 8.8.3 Description An authenticated user with the consumer role can trigger server-side request forgery by registering a webhook URL that points to an internal host. The webhook registration endpoint validates URL syntax usi...

PT-2026-70141

Name of the Vulnerable Software and Affected Versions Friendica versions prior to 2026.08-dev Description An authenticated user with a self-registered account can perform a server-side request forgery SSRF through the link-preview endpoint. This occurs because the endpoint fetches user-supplied...

PT-2026-70938

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 2.0.0 Description An issue exists where the http function in HttpFunction.java passes a user-controlled URI argument to URI.create and the server-side HTTP client. Because the system does not restrict private, loopback...

Linux Distros Unpatched Vulnerability : CVE-2026-68379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: tcp: fix TIMEWAIT socket reference leak on PSP policy failure Release the TIMEWAIT socket...

PT-2026-70828

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.16.0 Description The addr less eq function in src/client/ns turn ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals within ioa addr in range. This allows an authenticated TURN client to relay...