EUVD-2026-65395

Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is...

Apicurio/apicurio-registry: apicurio-registry: Unhardened SAXParser in content-type detection leads to blind XXE / SSRF / billion-laughs DoS

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission or unauthenticated when the registry runs with default...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM DevOps Code ClearCase. Information about security vulnerabilities affecting WAS have been published in a security bulletin. CVE-2026-50645, CVE-2026-9322, CVE-2026-9171 , CVE-2026-11541 ,CVE-2026-8408, CVE-2026-11712,...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM DevOps Code ClearCase. Information about security vulnerabilities affecting WAS have been published in a security bulletin. CVE-2026-9006, CVE-2026-9311, CVE-2026-9330, CVE-2026-10845, CVE-2026-9072, CVE-2026-8858,...

Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)

More info at https://contao.org/en/security-advisories/cross-site-request-forgery-in-custom-backend-actions...

Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)

More info at https://contao.org/en/security-advisories/cross-site-request-forgery-in-custom-backend-actions...

UBUNTU-CVE-2026-56706

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...

UBUNTU-CVE-2026-34964

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

CVE-2026-34964

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

CVE-2026-78682

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen and callers nltk.data.load, nltk.downloader.Downloader.index/download when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables...

CVE-2026-56708 Grav API Plugin before 1.0.16 SSRF via DNS Rebinding

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresse...

CVE-2026-56708

The Grav API plugin before version 1.0.16 is affected by a server-side request forgery (SSRF) vulnerability in its webhook delivery mechanism. The root cause is a DNS rebinding attack that bypasses hostname validation: an attacker who controls the authoritative DNS for a configured webhook hostna...

EUVD-2026-65197

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

CVE-2026-34964

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

CVE-2026-56708: Time-of-check Time-of-use (TOCTOU) Race Condition

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresse...

PT-2026-81483

In Dradis Community Edition, the ProvidersController and AgentsController gate their admin required before action on defined?Dradis::Pro, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated non-admin user can create an AI provider...

Linux Distros Unpatched Vulnerability : CVE-2026-75975

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an...

CVE-2026-34964: Server-Side Request Forgery (SSRF)

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

JetBrains TeamCity < 2020.2.3 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2020.2.3. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages. CVE-2021-31908 - In JetBrains TeamCity before 2020.2.3, argument injectio...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the process that maps CloudEvent extension fields onto message headers without applying any header filter strategy in structured content...