CVE-2026-72529

TrueConf Server (videoconferencing) is affected by a missing authentication vulnerability in an undocumented function accessible via port 4307/TCP . A remote unauthenticated attacker can invoke this function to execute an arbitrary script on the server. Affected versions: 5.3.X–5.3.9, 5.4.X–5.4.9...

EUVD-2026-62585

keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery SSRF guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSR...

CVE-2026-75583 keeper.sh Calendar version prior to 2.18.14 SSRF Guard Bypass via DNS Rebinding

keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery SSRF guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSR...

CVE-2026-75583

keeper.sh calendar module versions prior to 2.18.14 contain an SSRF guard bypass vulnerability exploitable via DNS rebinding . The root cause is a design flaw in the two-phase URL validation flow: the SSRF guard resolves and validates a hostname's IP addresses but discards them before the actual ...

mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Clone Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...

mysql: JSON unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily...

CVE-2026-62668

Grav API Plugin (RESTful API for Grav CMS) prior to 1.0.6 is vulnerable to SSRF via unrestricted cURL protocols in webhook dispatch. The WebhookController.php accepts webhook URLs with only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS...

CVE-2026-76225 ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV

ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB...

CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service. Mitigation Restrict network access...

mysql: Replication unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...

mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Clone Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...

mysql: InnoDB unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable...

mysql: X Plugin unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: X Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily...

mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Clone Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...

mysql: JSON unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily...

mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and...

mysql: Optimizer unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily...

Vulnerabilities in Oracle PeopleSoft Enterprise

Oracle has identified several vulnerabilities in Oracle PeopleSoft Enterprise PeopleTools, including the Integration Broker, Data Mover, Configuration Manager, FIN Common Objects, FIN Lease Administration, and CC Common Application Objects, specifically in versions 8.61 through 8.63 and 9.1 throu...

CVE-2026-76164

CVE-2026-76164 is a non-blind SSRF in the AIL Framework crawler submission functionality. A low-privileged authenticated user can submit arbitrary URLs for crawling without adequate destination validation. Manual crawler tasks bypass the existing domain blacklist (assigned non-zero priority), and...

CVE-2026-17565 Animation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request Forgery

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back...