CVE-2026-14540 Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox

A Server-Side Request Forgery SSRF vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client...

EUVD-2026-51373

An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service DoS. The /mcp endpoint handler reads incoming payloads directly into system memory using a...

CVE-2026-14539 Denial of Service via Unrestricted Payload Buffering in MCP Toolbox

An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service DoS. The /mcp endpoint handler reads incoming payloads directly into system memory using a...

SUSE CVE-2026-15157

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...

IBM Langflow OSS path traversal vulnerability

IBM Langflow OSS is an open-source low-code visual AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to integrate wit...

CVE-2026-51785

An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...

PT-2026-66765

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...

CVE-2026-51785

CVE-2026-51785 affects Hugo Leisink Hiawatha prior to 12.2. The incident is a remote code execution vulnerability triggered by a crafted request to the server. The available connected documents confirm the flaw and the affected version range, with remediation guidance to upgrade to version 12.2 o...

CVE-2026-51785

An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...

Linux Distros Unpatched Vulnerability : CVE-2026-15722

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a...

GitLab 11.8 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-15975)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an...

JFrog Artifactory < 7.133.6 SSRF

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.133.6. It is, therefore, affected by a server-side request forgery SSRF vulnerability. - Improper URL validation when handling specific URLs, allows an attacker, under certai...

PT-2026-66737

Name of the Vulnerable Software and Affected Versions 389 Directory Server 389-ds-base affected versions not specified Description A stack buffer overflow occurs in the get ruvelement from berval function within repl5 ruv.c. The issue arises when digit characters from a network-supplied RUV berva...

PT-2026-66866

Name of the Vulnerable Software and Affected Versions xxl-job version 3.4.0 Description A Server-Side Request Forgery SSRF exists in the 'xxl-job-admin/jobinfo/trigger' endpoint. This issue allows authenticated attackers to scan internal resources by sending a specially crafted HTTP request. SSRF...

IBM WebSphere Application Server input validation error vulnerability

IBM WebSphere Application Server is an application server product from IBM. Versions 8.5 and 9.0 of IBM WebSphere Application Server have security vulnerabilities. These vulnerabilities stem from input validation flaws in the HTTP request parsing component, leading to inconsistent interpretation ...

CVE-2026-52371

A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...

PT-2026-66858

Name of the Vulnerable Software and Affected Versions Hugo Leisink Hiawatha versions prior to 12.2 Description A flaw allows a remote attacker to execute arbitrary code by sending a specially crafted request to the server. Recommendations Update Hugo Leisink Hiawatha to version 12.2 or later...

FreeBSD : Gitlab -- vulnerabilities (661d3db5-8bd9-11f1-9c40-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 661d3db5-8bd9-11f1-9c40-2cf05da270f3 advisory. Gitlab reports: Sensitive Information Exposure issue in Workhorse impacts GitLab CE/EE Mass...

CVE-2026-66349

The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER tag is received over an established session, the decoder may advance its internal buffer incorrectly due to a missing bounds check. This...

CVE-2026-63550

The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session TCP port 102, the decoder may advance its internal read position incorrectly, leading to a he...