26044 matches found
CVE-2026-74247
A flaw was found in Red Hat Quay. A user with FEATUREBUILDSUPPORT enabled and repository write access can exploit a Server-Side Request Forgery SSRF vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network...
MINI-RG49-H5RP-JFGR
Bulletin has no description...
CVE-2026-74247 Quay: ssrf via build archive_url in quay build api
A flaw was found in Red Hat Quay. A user with FEATUREBUILDSUPPORT enabled and repository write access can exploit a Server-Side Request Forgery SSRF vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network...
GO-2024-2428 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller...
VulnCheck KEV: CVE-2026-59309
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system...
openstack-glance: OpenStack Glance: Server-Side Request Forgery leading to unauthorized internal network access
A flaw was found in OpenStack Glance. An authenticated user can exploit a Server-Side Request Forgery SSRF vulnerability within the web-download import feature. This vulnerability stems from inadequate validation of Uniform Resource Identifiers URIs, which can be circumvented using HTTP redirects...
CVE-2026-18164
creationtimestamp| type| source ---|---|--- 2026-08-13 20:15:03+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-225-01...
CVE-2026-58508
Two SSRF vulnerabilities in Gitea migration/mirror DNS rebinding + missing re-validation...
CVE-2026-58314 Two SSRF findings in Gitea 1.26.2
Two SSRF findings in Gitea 1.26.2...
CVE-2026-49856 @jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization
@jshookmcp/jshook is an MCP server that gives AI agents tools for JavaScript analysis and security research. In version 0.3.1, he network domain has a central SSRF authorization policy that blocks private, loopback, link-local, and reserved targets unless an explicit authorization object allows...
CVE-2026-0301
An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability...
EUVD-2026-57714
An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability...
Linux Distros Unpatched Vulnerability : CVE-2026-53801
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumera...
Palo Alto Networks PAN-OS 10.2.x < 10.2.8 / 11.1.x < 11.1.16-h1 Vulnerability
The version of Palo Alto Networks PAN-OS running on the remote host is 10.2.x prior to 10.2.8 or 11.1.x prior to 11.1.16-h1. It is, therefore, affected by a vulnerability. An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS software enables an...
CVE-2026-65941
In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...
CVE-2026-65941 WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.
In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...
CVE-2026-65941
In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...
CVE-2026-49262
In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route cmsproxy is vulnerable to a Server-Side Request Forgery SSRF attack via DNS Rebinding. A Time-of-Check to Time-of-Use TOCTOU race condition exists between the URL validation phase and the actua...
EUVD-2026-57105
The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary...