CVE-2026-109460

Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to disclose information locally...

EUVD-2026-121576

Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to disclose information locally...

CVE-2026-109460

The Microsoft Entra Private Network Connector is affected by an information disclosure vulnerability (CVE-2026-109460 ). This flaw allows an authorized attacker to disclose sensitive information locally to an unauthorized actor. The vulnerability is associated with CWE-200 . While the specific ro...

Microsoft Entra Private Network Connector Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to disclose information locally...

PT-2026-143404

Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to disclose information locally...

CVE-2026-123119

The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x...

CVE-2026-123119

A flaw was found in the Symfony HttpClient component. The client fails to properly pin verified IP addresses for cached hostnames across subsequent requests, causing the host to be re-resolved. A remote attacker controlling an external Domain Name System DNS server can exploit this behavior throu...

Linux Distros Unpatched Vulnerability : CVE-2026-123119

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private...

CVE-2026-68935

Chartbrew is an open-source web application for creating charts from databases and APIs. In versions 4.8.5 through 5.2.2, API connection creation and update operations accept the internal allowPrivateHost field from user input. An authenticated user with permission to manage API connections can...

EUVD-2026-118510

Chartbrew is an open-source web application for creating charts from databases and APIs. In versions 4.8.5 through 5.2.2, API connection creation and update operations accept the internal allowPrivateHost field from user input. An authenticated user with permission to manage API connections can...

CVE-2026-68935

The open-source web application Chartbrew versions 4.8.5 through 5.2.2 is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is that API connection creation and update operations accept the internal allowPrivateHost field from user input. An authenticated user with permissions to...

PT-2026-138449

Name of the Vulnerable Software and Affected Versions Chartbrew versions 4.8.5 through 5.2.2 Description An authenticated user with permissions to manage API connections can bypass private and reserved-network destination restrictions. This occurs because API connection creation and update...

UBUNTU-CVE-2026-123119

The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x...

6 Best VPN Services (2026), Tested and Reviewed

Every VPN says it’s the best, but only some of them are telling the truth...

PT-2026-136188

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.24.0 Description Station users with WebHooks permission can bypass the UserUrlFilter guard using the Mastodon, Telegram, GroupMe, and RadioReg connectors. By setting the instance url, api, or webhookurl variables ...

fcn-

fcn free connect your private network from anywhere 1. What is fcn fcnfree connect is a foolproof one-click tool for accessing private networks, consisting of the server side and the client side fcn uses fcn public data servers and data encryption technology to virtually connect user clients to...

Astra Linux – vulnerability in OpenVPN

OpenVPN 2.5.1 and earlier versions allow remote attackers to bypass authentication and access control mechanisms on servers that have deferred authentication enabled; this can potentially lead to further information leaks...

Astra Linux – Vulnerability in libcommons-net-java

Prior to Apache Commons Net 3.9.0, Net’s FTP client trusted the host based on the PASV response by default. A malicious server could redirect the Commons Net code to use a different host, but the user had to connect to the malicious server in the first place. This could result in the leakage of...

CVE-2026-25946 Gitea OpenID discovery server-side request forgery

When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can...

CVE-2026-25946 Gitea OpenID discovery server-side request forgery

When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can...