ECHO-1A92-FEB4-84CA

Bulletin has no description...

CVE-2026-73432 Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

CVE-2026-73432 Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

EUVD-2026-57231

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

CVE-2026-73432

CVE-2026-73432 affects Vulnerability-Lookup: SSRF via remote-instance synchronization where addresses were only validated for syntax before storage and later dereferenced with requests.get(), following redirects without network-boundary checks. An authenticated admin (admin:access) can configure ...

CVE-2026-73263 Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path

Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfigcontent containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfigcontainsexecauth in api/src/backend/api/v1/serializers.py checked only exec...

CVE-2026-73263 Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path

Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfigcontent containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfigcontainsexecauth in api/src/backend/api/v1/serializers.py checked only exec...

CVE-2026-73077

creationtimestamp| type| source ---|---|--- 2026-08-12 13:45:52+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-vim-1...

CVE-2026-26035

An Improper Authentication vulnerability CWE-287 vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

Malicious code in dakumangalsingh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...

EUVD-2026-57193

An Improper Authentication vulnerability CWE-287 vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb...

CVE-2026-26035

An Improper Authentication vulnerability CWE-287 vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb...

CVE-2026-26035

An Improper Authentication vulnerability CWE-287 vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb...

CVE-2026-26035

Fortinet FortiWeb is affected by CVE-2026-26035 (Improper Authentication - CWE-287). Versions impacted: FortiWeb 8.0.0–8.0.2, 7.6.0–7.6.6, 7.4.0–7.4.11, 7.2.0–7.2.12, 7.0.0–7.0.12. A remote unauthenticated attacker could log into the FortiWeb GUI/CLI using a random username and password. The CVSS...

CVE-2026-70467

A server-side request forgery ssrf vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all...

CVE-2026-70467

A server-side request forgery ssrf vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all...

EUVD-2026-57190

A server-side request forgery ssrf vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all...

CVE-2026-70467

Fortinet FortiSIEM is affected by a server-side request forgery (SSRF) vulnerability across multiple versions: 7.5.0; 7.4.x (7.4.0–7.4.2); 7.3.x (7.3.0–7.3.5); and all releases of 7.2, 7.1, 7.0, 6.7, 6.6, and 6.5. The issue may allow an attacker to execute unauthorized code or commands via an att...

Denial-of-service (DoS)

Apache HttpComponents Core is vulnerable to a denial-of-service DoS vulnerability. The vulnerability is due to the decoder processing oversized compressed HTTP/2 header blocks without applying the configured header list size limit until the SETTINGS acknowledgement, which allows a remote attacker...