CVE-2026-69502

CVE-2026-69502 is a server-side request forgery (SSRF) vulnerability in Azure SQL Database that allows an unauthorized, network-based attacker to elevate privileges . The CNA-assigned CVSS 3.1 score is 10.0 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating no privileges ...

CVE-2026-68554

A flaw was found in Coturn, a free open source implementation of TURN and STUN Session Traversal Utilities for NAT Server. An on-path attacker can exploit this vulnerability on plain UDP or TCP by appending attributes after the MESSAGE-INTEGRITY field in an authenticated STUN request. This allows...

CVE-2026-13176 Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...

Security update for sccache

This update for sccache fixes the following issues: CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes bsc1274146. CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values bsc1273881. CVE-2026-66754: rouille:...

CVE-2026-59085

Apache CloudStack contains a Server-Side Request Forgery (SSRF) vulnerability in its webhook module , exploitable via webhook delivery requests. The affected versions span 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 . An attacker who can influence webhook delivery targets may be able ...

EUVD-2026-63845

Server-Side Request Forgery SSRF vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1....

CVE-2026-61397

Apache CloudStack is affected by an OAuth2 Token Cross-Request Leak in its OAuth2 authentication plugin and Google OAuth integration, classified as Exposure of Sensitive Information to an Unauthorized Actor . The vulnerability allows sensitive OAuth2 tokens to leak across requests, potentially ex...

CVE-2026-77391

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...

CVE-2026-77391 SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...

CVE-2026-77391

SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 is vulnerable to cross-site request forgery (CSRF) via an unidentified function. CVSS 4.0 scores it MEDIUM (5.3); the attack is remote, requires no privileges and passive user interaction, with integrity impact. A proof-of-...

EUVD-2026-63796

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...

EUVD-2026-63759

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and it...

EUVD-2026-63732

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...

EUVD-2026-63629

Server-side request forgery ssrf in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network...

Linux Distros Unpatched Vulnerability : CVE-2026-63382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate...

PT-2026-79396

Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-72846

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored...

CVE-2026-72848

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...

CVE-2026-69851

Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...

CVE-2026-69543

An SSRF vulnerability in Azure Virtual Machines allows an authorized low-privilege attacker to elevate privileges over a network, with a HIGH CVSS 3.1 base score of 8.5. No patch version, workaround, or exploitation evidence is provided in the documents.