K000162214: Linux kernel mt76 wireless driver vulnerbaility CVE-2026-53102

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix memory leak after mt76connacmcuallocstareq mt76connacmcuallocstareq allocates an skb which is expected to be freed eventually by mt76mcuskbsendmsg. However, currently if an intermedia...

Server-side request forgery (SSRF) via unvalidated RSS feed URLs

More info at https://contao.org/en/security-advisories/server-side-request-forgery-via-unvalidated-rss-feed-urls...

CVE-2026-49876 Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs

Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. A vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 through 1.2.1. Users are recommended to upgrade to...

CVE-2026-61970

Server-Side Request Forgery SSRF vulnerability in Themeisle Auto Featured Image Auto Post Thumbnail auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image Auto Post Thumbnail: from n/a through = 5.0.4...

CVE-2026-57407

The vulnerability concerns the WordPress plugin PDF Generator for WordPress (plugin name shown as pdf-generator-for-wp) and is described as a Server-Side Request Forgery (SSRF) . Affected versions are listed as “from n/a through

CVE-2026-62143 Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addresses

A Server-Side Request Forgery SSRF protection bypass existed in the htmltomarkdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges...

MAL-2026-10414 Malicious code in express-request-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650f45223a2abc34039d499274c1cce89abdf6b4be571d326b73e2b10da48e30 The package's main entry index.js presents itself as a normalize-path utility but on module load calls initPlugin at top level, which performs an HTT...

Malicious code in express-request-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650f45223a2abc34039d499274c1cce89abdf6b4be571d326b73e2b10da48e30 The package's main entry index.js presents itself as a normalize-path utility but on module load calls initPlugin at top level, which performs an HTT...

MAL-2026-10413 Malicious code in eth-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcc98bc680f3d0b8c6dcf396d9f2425a5153658259014384cedf82698413755b The published lib/index.js contains 60KB of obfuscated JavaScript appended after a copy of the legitimate web3.js web3-core-subscriptions module. On...

MAL-2026-10410 Malicious code in cookie-phase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17bfab347de8288575bca9677b9eb7652b0024cdbffc1efebe387378c243299c The package presents itself as the popular pino logger README badges, exported module.exports.pino = middleware but its name and metadata are...

MAL-2026-10385 Malicious code in speed5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1eec0d2d56f1e9730af8b7f3a7b8897e86491d48663f7b09ae7c716f6b3c0092 [email protected] is not a functional Node package. package.json declares main: sw.js, but sw.js is a browser ServiceWorker importScripts'./8cfc2/hgshm.js...

Server-side Request Forgery (SSRF)

Overview adloop is a The AI command center for Google Ads, GA4, and tracking code. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the validateurls function. An attacker can induce the server to make arbitrary HTTP requests by supplying crafted input to th...

MAL-2026-10219 Malicious code in chai-as-precision (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b5d1218fae5d91755d8f9ca8ed37983e7d589c6fd88012d3ddb29a84a2cc56 Package is published as chai-as-precision but its shipped code mimics pino exports middleware.pino, ships pino.js/proto.js/redaction.js, a name/purpo...

CVE-2026-15529 yzhao062 pyod persistence.py pyod.utils.persistence.load deserialization

A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. Upgrading to version 3.6.2 is abl...

EUVD-2026-43249

A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function buildtargeturl of the file ai-gateway/src/dispatcher/service.rs of the component AWS Metadata Service. Executing a manipulation of the argument extractedpathandquery can lead to server-side request forgery...

PT-2026-59385

Summary The SafePlaywrightURLLoader implements a validate url function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only on the initial URL. Since Playwright automatically follows HTTP redirects 301/302 by default, an attacker...

Linux Distros Unpatched Vulnerability : CVE-2026-15146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that...

PT-2026-59686

A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made...

PT-2026-59020

A security vulnerability has been detected in Aider-AI Aider 0.86.3.dev. This affects the function requests.get of the file api docs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit...

PT-2026-59628

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. Patches This has been fixed in pypdf==6.10.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 3724...