CVE-2026-89826 drm/panthor: harden firmware build-info bounds checks

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: harden firmware build-info bounds checks panthorfwreadbuildinfo checks whether the metadata range fits in the firmware image with hdr.metastart + hdr.metasize. Both fields are u32, so the addition can wrap and let an...

CVE-2026-92774: Incorrect Authorization

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions,...

CVE-2026-77408: Integer Overflow or Wraparound

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId,...

CVE-2026-92568: Server-Side Request Forgery (SSRF)

MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows authenticated users to make the API server send arbitrary HTTP requests to internal addresses. Attackers can update a run with a malicious webhook notification that executes wh...

PT-2026-93798

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0 Description A data integrity and protocol corruption issue exists in the property serialization logic of the AMQP client. When encoding AMQP short string shortstr fields, the writeShortstr function ...

PT-2026-93811

Name of the Vulnerable Software and Affected Versions DataGear versions prior to 6.0.1 Description An issue exists where unauthenticated attackers can execute arbitrary HTTP requests by providing a caller-controlled URI. This occurs via the '/dataSet/preview/Http' endpoint, allowing the issuance ...

PT-2026-93788

Name of the Vulnerable Software and Affected Versions rmcp versions prior to 2.0.0 Description The OAuth implementation in the rmcp crate fails to validate the resource parameter in OAuth Protected Resource metadata as required by RFC 9728. Specifically, the ResourceServerMetadata struct omits th...

PT-2026-93813

Name of the Vulnerable Software and Affected Versions MLRun versions prior to 1.11.0 Description An issue exists in the WebhookNotification handler that allows authenticated users to perform server-side request forgery SSRF. By updating a run with a malicious webhook notification, an attacker can...

CVE-2025-56563

A Server-Side Request Forgery (SSRF) vulnerability exists in the sat_proxy.php script of Zenith Satellite Tracker 1.0 . The root cause is the script's acceptance of an attacker-controlled address URL parameter and its subsequent pass to curl_setopt(CURLOPT_URL) without performing any host or sche...

CVE-2025-56563

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

PT-2026-93946

A Server-Side Request Forgery vulnerability exists in sat proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl setoptCURLOPT URL without host or scheme validation. An unauthenticated remote attacker can leverage this to...

CVE-2026-92804: Server-Side Request Forgery (SSRF)

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potential...

CVE-2026-92750: Missing Authorization

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to...

CVE-2025-56563: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

CVE-2026-92566: Server-Side Request Forgery (SSRF)

DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to interna...

PT-2026-94072

Name of the Vulnerable Software and Affected Versions Coze Studio versions prior to 0.5.2 Description Authenticated users can exploit a lack of restriction on the server URL provided during the registration of plugin tools. This allows the backend to fetch internal services, enabling attackers to...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38589)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the meshInfoKick function. Attackers can exploit this vulnerability by sending specially crafted MQTT...

CVE-2026-92795: Server-Side Request Forgery (SSRF)

Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the...

CVE-2026-92775: Server-Side Request Forgery (SSRF)

Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the serv...

CVE-2026-54544

Fireshare , a self-hosted media and link sharing platform, contains an unauthenticated SSRF vulnerability prior to version 1.6.16 . Two API endpoints—POST /api/test-discord-webhook and POST /api/test-webhook—are missing the @login_required decorator, allowing an attacker to trigger arbitrary outb...