CVE-2026-53413 Zoom Clients - Buffer Over-write

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access...

Microsoft SharePoint Server Spoofing Vulnerability

Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

Double free in Windows Secure Socket Tunneling Protocol SSTP allows an unauthorized attacker to execute code over a network...

.NET Information Disclosure Vulnerability

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...

RPC Runtime Library Remote Code Execution Vulnerability

Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to execute code over a network...

Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Device Health Attestation DHA allows an unauthorized attacker to execute code over a network...

Microsoft Excel Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network...

PowerShell Information Disclosure Vulnerability

Server-side request forgery ssrf in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network...

Visual Studio Code Security Feature Bypass Vulnerability

Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-73210 Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...

CVE-2026-72768

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection...

CVE-2026-50236

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-72598 Apioo Fusio - Server-Side Request Forgery

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

EUVD-2026-55992

Affected versions of cti-transmute contain an SSRF vulnerability in the /fetchmispevent and /mispsearchevents endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain...

Security Bulletin: Vulnerability in Java affects IBM Netezza Appliance

Summary The Java package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-34282 Vulnerability Details CVEID:CVE-2026-34282 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to...

CVE-2026-18348 Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...

EUVD-2026-55938

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516 CVE-2026-19516 CVE Record

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

PT-2026-70604

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Incorrect authorization allows an authorized attacker to perform tampering over a network, which enables them to affect the system. Recommendations At the moment, there is...

PT-2026-70261

Name of the Vulnerable Software and Affected Versions Zoom Clients affected versions not specified Description A Use after Free issue exists in the annotator function. This flaw allows a meeting participant to achieve remote code execution on another participant's system via network access. Use...