CVE-2026-93379

A flaw was found in Google Chrome. This incorrect authorization vulnerability in the Object Request Broker ORB component allows a remote attacker to bypass site isolation. By crafting a malicious HTML page, an attacker can exploit this flaw, potentially leading to unauthorized access to sensitive...

CVE-2026-75743 Adobe Experience Manager Forms JEE | Cross-Site Request Forgery (CSRF) (CWE-352)

Adobe Experience Manager Forms JEE is affected by a Cross-Site Request Forgery CSRF vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access, causing a limited disruption to...

CVE-2026-75743

Adobe Experience Manager Forms JEE is affected by a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). This flaw allows an attacker to bypass security measures and gain unauthorized write access , potentially leading to a limited disruption of availability. Successful exploitation require...

CVE-2026-75743 Adobe Experience Manager Forms JEE | Cross-Site Request Forgery (CSRF) (CWE-352)

Adobe Experience Manager Forms JEE is affected by a Cross-Site Request Forgery CSRF vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access, causing a limited disruption to...

CVE-2026-82000 Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user...

CVE-2026-95656

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function addwatchuisnapshot of the file changedetectionio/blueprint/addwatchui/init.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-77243

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to an authorization bypass in versions prior to 0.22.0 . The root cause is that while ENABLED_TOOLS and TOOLSETS are applied during tool listing, they are not rechecked when a tools/call request is dispatched. T...

EUVD-2026-84624

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

CVE-2026-77267 mcp-atlassian has an incomplete SSRF remediation

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by processauthenticationheaders and used to construct Atlassian fetchers without calling...

CVE-2026-83660 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2026-82013 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user...

CVE-2026-95656

The dgtlmoon changedetection.io software (up to version 50389b07 ) is vulnerable to a server-side request forgery (SSRF) vulnerability in the Preview Endpoint component. The flaw exists within the add_watch_ui_snapshot function of the file changedetectionio/blueprint/add_watch_ui/__init__.py, whe...

EUVD-2026-84576

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function addwatchuisnapshot of the file changedetectionio/blueprint/addwatchui/init.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-80150

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the...

CVE-2026-79913

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated...

CVE-2026-88004

A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. Its entrypoint defenses, designed to sanitize header names, failed to inspect request trailers. This allowed an unauthenticated client to submit malicious header names within HTTP/1.1 chunked or HTTP/2 trailers...

CVE-2026-88012

A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. Its HTTP/3 entrypoints do not correctly apply read timeouts, which are intended to prevent prolonged connections. An unauthenticated client can exploit this by sending a slow request body, continuously trickling dat...

EUVD-2026-84527

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated...

EUVD-2026-84516

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet...

EUVD-2026-84515

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH...