CVE-2026-75340

The device metadata import interface /device/instance/productId/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery SSRF...

PT-2026-82258

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery SSRF vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...

CVE-2026-75332

Zyplayer-Doc =1.0.0 is vulnerable to Server-Side Request Forgery SSRF via WikiPageWebService.download...

CVE-2025-61162

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

CVE-2026-75329

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

CVE-2026-75332

Zyplayer-Doc =1.0.0 is vulnerable to Server-Side Request Forgery SSRF via WikiPageWebService.download...

EUVD-2026-66748

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

CVE-2026-7487: Access Control Check Implemented After Asset is Accessed

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules du...

CVE-2026-75329: Missing Authentication for Critical Function

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098899)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098899 advisory. In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fusetrymovefolio unlocks the request on...

CVE-2025-56798

Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy...

CVE-2026-75415

AntFlow V2.0.0 is vulnerable to Incorrect Access Control due to a flaw in the JiMuMDCCommonsRequestLoggingFilter.java component. The application improperly uses the userid from the request header as the primary mechanism for identity verification. This allows an attacker to forge user identity cr...

CVE-2025-61162

Cohere North AI v1.1.5 is affected by an incorrect access control vulnerability. A remote attacker can send a specially crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint to arbitrarily overwrite user information , leading to unauthorized modification of user data. To mitigate thi...

CVE-2026-75332

Zyplayer-Doc versions 1.0.0 and earlier are vulnerable to Server-Side Request Forgery (SSRF) . This flaw exists in the WikiPageWebService.download() function, which can be leveraged by an attacker to induce the server to make requests to unintended locations. While no patched version is currently...

CVE-2025-61162: Improper Access Control

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098789)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098789 advisory. In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing The Supported Rates IE...

CVE-2026-77573: Time-of-check Time-of-use (TOCTOU) Race Condition

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...

PT-2026-82292

This is a classic "roundup" post. Since the summary is generic "top threats you should know about" and the source is a vendor F5, I need to assume this is a curated list of multiple events. I will treat this as Scenario A Technical Threat but structure it as a digest of multiple items, pulling fr...

From Verdict to Diagnosis: Attributable Security Review of Pull Requests

Automated code reviewers are increasingly used as gates on pull requests PRs, yet evaluations measure whether they block a malicious change. A block may be triggered by an unrelated issue rather than the vulnerability that makes the PR unsafe; fixing the reported issue can leave the target defect...

PT-2026-82100

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.1 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 through 19.3.0 Description An improper authorization check allows an authenticated user with reporter-role permissions who authored a merge...