CVE-2026-85650

Trigger.dev versions before 4.5.2 contain a server-side request forgery (SSRF) vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal servi...

CVE-2026-85650 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

EUVD-2026-71224

DouyinTikTokDownloadAPI through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/videodata endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services including...

CVE-2026-85608

Douyin_TikTok_Download_API (through version 4.1.2 ) is vulnerable to server-side request forgery (SSRF) in the /api/download and /api/hybrid/video_data endpoints. An unauthenticated attacker can supply an arbitrary url query parameter to make the server fetch internal resources, including cloud m...

Unverified Password Change

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Unverified Password Change via the user control panel API endpoint. An attacker can gain unauthorized access to user accounts by submitting a crafted PU...

Unverified Password Change

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Unverified Password Change via the user control panel API endpoint. An attacker can gain unauthorized access to user accounts by submitting a crafted PU...

CVE-2026-85585

SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory an...

CVE-2026-85614 OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue request...

EUVD-2026-71033

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue request...

CVE-2026-85613 OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...

CVE-2026-85612 OpenPanel before 2.3.0 SSRF via favicon and og endpoints

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata...

CVE-2026-85612

OpenPanel before 2.3.0 contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /misc/favicon and /misc/og endpoints. These endpoints accept an attacker-supplied url parameter with insufficient validation, allowing an attacker to force the API to fetch arbitrary interna...

CVE-2026-85585

SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in its request-concurrency middleware (ControlConcurrency). The middleware retains mutex entries for every unique request path without any eviction mechanism . An unauthenticated remote attacker can send numerous unique...

EUVD-2026-71008

SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory an...

UBUNTU-CVE-2026-85534

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGSINITIALWINDOWSIZE while that buffered read is still in progres...

CVE-2026-85534

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGSINITIALWINDOWSIZE while that buffered read is still in progres...

CVE-2026-85546

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-84504

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...

CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...

CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...