281 matches found
GHSA-CMHJ-WH2F-9CGX 9router: Image prefetch DNS rebinding allows SSRF to internal services
Summary 9router validates image URLs by resolving the host before fetching, but the later server-side fetch performs a separate DNS resolution. An attacker-controlled DNS name can resolve to a public IP during validation and then rebind to an internal Docker/private IP during the fetch. This allo...
9router: Image prefetch DNS rebinding allows SSRF to internal services
9router validates image URLs by resolving the host before fetching, but the later server-side fetch performs a separate DNS resolution. An attacker-controlled DNS name can resolve to a public IP during validation and then rebind to an internal Docker/private IP during the fetch. This allows the...
CVE-2026-92775
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the serv...
EUVD-2026-81039
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the serv...
CVE-2026-92775 Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the serv...
CVE-2026-92775 Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the serv...
CVE-2026-92775 Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the serv...
CVE-2026-92775
Wiki.js through 2.5.314 is affected by a Server-Side Request Forgery (SSRF) vulnerability in the Image Prefetch renderer . The root cause is the absence of protocol, host, or address validation when fetching image URLs. An attacker with page editing permissions can inject elements carrying the p...
AZL-103188 CVE-2026-77406 affecting package keda 2.14.1-19
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQos is absent. Values such as -1 therefore wrap to 65535 o...
CVE-2026-77406 RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQos is absent. Values such as -1 therefore wrap to 65535 o...
PT-2026-94053
Name of the Vulnerable Software and Affected Versions Wiki.js versions prior to 2.5.315 Description The Image Prefetch renderer allows server-side request forgery, a flaw where the server is tricked into making requests to an unintended location. This occurs because the renderer fetches arbitrary...
CVE-2026-92775: Server-Side Request Forgery (SSRF)
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the serv...
Chromium CVE-2026-87619: Observable discrepancy in Prefetch
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nfqueue – fixed a possible use-after-free issue. Eric Dumazet says: The sockhold function seems suspicious, as there is no guarantee that skrefcnt is not already 0. In case of failure, we cannot queue the packet and...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: Fixed the issue where the SoC may hang during 16-byte unaligned reads. There is an errata regarding the chip ls1028a: The SoC may hang during 16-byte unaligned read transactions initiated by QDMA. Unaligned...
SUSE CVE-2026-87619
Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...
CVE-2026-87619
An observable discrepancy flaw was found in the Prefetch component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=497433347...
CVE-2026-87619
Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...
DEBIAN-CVE-2026-87619
Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...
