PT-2026-97553

Name of the Vulnerable Software and Affected Versions sfturing hosp order versions up to 627f426331da8086ce8fff2017d65b1ddef384f8 Description A remote attack can lead to cross-site request forgery, which occurs when a malicious site tricks a user's browser into performing an unwanted action on a...

CVE-2026-90900: Cross-Site Request Forgery (CSRF)

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint index.php?option=comeasystore&task=product.addReview accepted submissions without verifying an anti-CSRF token t...

PT-2026-97687

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.11 through 19.2.6 GitLab CE/EE versions 19.3 through 19.3.2 GitLab CE/EE versions 19.4 Description An issue exists where improper sanitization of path components in the merge request diff viewer could allow an...

CVE-2026-92284: Allocation of Resources Without Limits or Throttling

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and proce...

CVE-2026-77756: Inconsistent Interpretation of HTTP Requests

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

Linux Distros Unpatched Vulnerability : CVE-2026-94108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on...

GitLab 19.1 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-92530)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an...

Linux Distros Unpatched Vulnerability : CVE-2026-62987

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses...

Critical: ipa security, bug fix, and enhancement update

AlmaLinux Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fixes: ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ip...

The vulnerability of the Goproxy proxy server’s HTTP request processing module allows attackers to bypass existing security mechanisms and gain unauthorized access to protected information.

The vulnerability of the Goproxy proxy server’s HTTP request processing module lies in the ability to bypass authentication by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent existing security mechanisms and gain unauthorized access to...

PT-2026-97275

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment...

CVE-2026-18066

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery...

CVE-2026-18066 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery...

CVE-2026-18066

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by vulnerabilities that could allow a local attacker to obtain sensitive information and trigger unauthorized actions. This is caused by server-side request forgery . No specific exploit details or remediation steps are prov...

CVE-2026-18066 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery...

CVE-2026-95813

e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails urlfor in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query...

CVE-2026-76909

Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML...

CVE-2026-75101 Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...

CVE-2026-75101

An authorization bypass vulnerability exists in GitHub Enterprise Server (versions prior to 3.22) due to a repository name collision flaw. Access tokens for raw pull request diffs and patches were incorrectly scoped to the repository name and pull request number rather than a globally unique iden...

GHSA-4GHV-53CQ-7WP3 Home Assistant: mDNS Server-Side Request Forgery

Summary Home Assistant Green is vulnerable to a Server-Side Request Forgery SSRF via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal servic...