89 matches found
Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure
Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/fID accepts an integer file ID in the URL and returns internal site structure data page IDs, versions, URL paths to anyone who sends a GET request. id:...
CVE-2026-91079
Huly Platform through 0.7.426 is affected by a server-side request forgery (SSRF) vulnerability in its print service . The root cause is a missing hostname allowlist validation : authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns a...
CVE-2026-91079 Huly Platform through 0.7.426 SSRF via Print Service
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images...
CVE-2026-82062
A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container...
CVE-2026-77067
Omnivore (open-source app) is vulnerable to a stored SSRF via the setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts. The resolver stores a caller-supplied URL without any address validation. When a subscribed event fires, callWebhook issues an axios.request to that URL with the r...
CVE-2026-66375
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions...
CVE-2026-71849
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...
CVE-2026-17595 Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass
Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...
CVE-2026-67530 WACRM: SSRF via the automation `send_webhook` action
WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation sendwebhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the...
CVE-2026-15974
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...
CVE-2026-15974
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...
EUVD-2026-51263
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...
CVE-2026-15974 CVE-2026-15974
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...
CVE-2026-15974 CVE-2026-15974
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...
CVE-2026-15974
SGLang (CVE-2026-15974) has a documented SSRF and local file-read flaw in the multimodal generation endpoint /v1/chat/completions caused by unsanitized image_url, enabling access to internal metadata, secrets, and services. The connected sources confirm the vulnerability details but do not provid...
CVE-2026-33267 Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue...
CVE-2026-33267
CVE-2026-33267 is an Improper Input Validation vulnerability in Apache Traffic Server. Affected are ATS 9.2.0–9.2.14 and 10.1.0–10.1.3; patch versions are 9.2.15 and 10.1.4. CVSS data from sources indicates Network-based, high-severity impact (CVSSv3.1: base score 10.0, Confidentiality/Integrity ...
CVE-2026-33267 Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue...
CVE-2026-65922
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...