EUVD-2026-70248

HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated...

CRLF Injection

Overview httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to CRLF Injection in the FileField.renderheaders method, which writes the per file contenttype value and any custom header names and values into the multipart part header block without rejecting...

CVE-2026-54745

A flaw was found in Kubeflow Pipelines. An unauthenticated attacker can exploit a Server-Side Request Forgery SSRF and HTTP smuggling vulnerability through the /proxy/ route. This allows the attacker to bypass authorization and forward arbitrary requests to internal services. Consequently, this c...

CVE-2026-84685 Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...

CVE-2026-66304

Server-side request forgery ssrf in Skype for Business allows an unauthorized attacker to disclose information over a network...

CVE-2026-28634

In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-86806 opengeos GeoLibre _is_within_roots server-side request forgery

A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function iswithinroots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name:...

CVE-2026-86806 opengeos GeoLibre _is_within_roots server-side request forgery

A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function iswithinroots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name:...

CVE-2026-86806 opengeos GeoLibre _is_within_roots server-side request forgery

A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function iswithinroots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name:...

CVE-2026-86806

A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function iswithinroots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name:...

Security Bulletin: Multiple vulnerabilities addressed in IBM SevOne Network Performance Management for August 2026

Summary IBM SevOne Network Performance Management has addressed these security vulnerabilities in the SD-WAN component with a Service Pack update. The publication of this security bulletin represents a change in our communication process, not an increase in security vulnerabilities. IBM SevOne...

CVE-2026-66304

CVE-2026-66304 is a server-side request forgery (SSRF) vulnerability in Skype for Business Server , affecting the Subscription Edition , 2019 , and 2015 releases. An unauthorized remote attacker with no privileges required can exploit the flaw to disclose information over a network . The CVSS v3....

EUVD-2026-74043

Server-side request forgery ssrf in Skype for Business allows an unauthorized attacker to disclose information over a network...

CVE-2026-81356

Inconsistent interpretation of http requests 'http request/response smuggling' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-81357

Server-side request forgery ssrf in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-81356

Inconsistent interpretation of http requests 'http request/response smuggling' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-69904

Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

CVE-2026-69683

Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

CVE-2026-28634

A logic error in the handleUssdRequest function of PhoneInterfaceManager.java allows an attacker to send USSD requests without the necessary permissions. This vulnerability could lead to a local escalation of privilege without requiring additional execution privileges or user interaction. Remedia...

CVE-2026-28634

In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...