PT-2026-31789

Name of the Vulnerable Software and Affected Versions PraisonAIAgents versions prior to 1.5.128 Description PraisonAIAgents is a multi-agent teams system. The web crawl function in praisonaiagents/tools/web crawl tools.py accepts arbitrary URLs from AI agents without validation. This includes a...

PT-2026-32543

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-44 ImageMagick versions prior to 7.1.2-19 Description A heap use-after-free issue occurs when reading and printing values from an invalid XMP profile, which can lead to a crash. Recommendations Update to...

CVE-2026-39974: Server-Side Request Forgery (SSRF)

n8n-MCP is a Model Context Protocol MCP server that provides AI assistants with comprehensive access to n8n node documentation, properties, and operations. Prior to 2.47.4, an authenticated Server-Side Request Forgery in n8n-mcp allows a caller holding a valid AUTHTOKEN to cause the server to iss...

Apache OpenMeetings security vulnerabilities

Apache OpenMeetings is a multilingual, customizable video conferencing and collaboration system developed by the Apache Foundation in the United States. This product supports audio and video capabilities, and allows users to view the desktops of each participant. Prior to Apache OpenMeetings 9.0....

Oma injection vulnerability

Oma is an AOSC-Dev open-source package manager for AOSC OS. Versions of Oma prior to 1.25.2 had a injection vulnerability. This vulnerability stemmed from Oma-topics not checking the transliterated value of the name field in metadata, which could allow malicious APT source entries to be added to...

Orthanc security vulnerabilities

Orthanc is a free open-source software developed by the Orthanc company. Orthanc has a security vulnerability, which stems from the DicomStreamReader’s tendency to read beyond the allocated boundaries of the metadata buffer during the parsing of DICOM meta-headers. This could lead to the parser...

CVE-2026-40150: Server-Side Request Forgery (SSRF)

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the webcrawl function in praisonaiagents/tools/webcrawltools.py accepts arbitrary URLs from AI agents with zero validation. No scheme allowlisting, hostname/IP blocklisting, or private network checks are applied before fetching. Thi...

PT-2026-31626

Name of the Vulnerable Software and Affected Versions DicomStreamReader affected versions not specified Description An out-of-bounds read issue exists in DicomStreamReader when parsing DICOM meta-headers. Processing malformed metadata structures can cause the parser to read beyond the allocated...

DEBIAN-CVE-2026-5902

Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream metadata via a crafted HTML page. Chromium security severity: Low...

CVE-2026-5902

Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream metadata via a crafted HTML page. Chromium security severity: Low...

CVE-2026-5902

Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream metadata via a crafted HTML page. Chromium security severity: Low...

CVE-2026-5902

Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream metadata via a crafted HTML page. Chromium security severity: Low...

CVE-2026-5902

Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream metadata via a crafted HTML page. Chromium security severity: Low...

CVE-2026-5902

A race condition in the Media component of Google Chrome on Android (prior to version 147.0.7727.55) allows a remote attacker to corrupt media stream metadata . This vulnerability can be triggered via a crafted HTML page by an attacker who has already compromised the renderer process . Exploitati...

CVE-2026-5902

Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream metadata via a crafted HTML page. Chromium security severity: Low...

CVE-2026-5902

Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream metadata via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-20511

A Server-Side Request Forgery SSRF vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered into PDF. When generating PDFs from user-controlled HTML content, the application...

EUVD-2026-20559

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back addresses, or link-local addresses — only the URL scheme HTTP/HTTPS as well as the hostname was checked. This could end up in retrieving...

CVE-2026-34719 Zammad has a Server-side request forgery (SSRF) via webhooks

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back addresses, or link-local addresses — only the URL scheme HTTP/HTTPS as well as the hostname was checked. This could end up in retrieving...

CVE-2026-34719

CVE-2026-34719 affects Zammad. The vulnerability is a server-side request forgery (SSRF) in the webhook model. Before 7.0.1 and 6.5.4, the webhook validation only checked the URL scheme and hostname, missing proper validation for loopback and link-local addresses, enabling potential access to con...