125732 matches found
EUVD-2026-49394
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUESTURI concatenation in call. When the rewrite base is a plain string, the REQUESTURI is appended to it, with no check that the path starts with a forward slash '/'. When the rewrite base does...
CVE-2026-17552
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUESTURI concatenation in call. When the rewrite base is a plain string, the REQUESTURI is appended to it, with no check that the path starts with a forward slash '/'. When the rewrite base does...
CVE-2026-17552
CVE-2026-17552 affects Plack::App::Prerender for Perl prior to 0.3.0. The flaw arises from unvalidated REQUEST_URI concatenation when the rewrite base is a plain string or lacks a path, allowing an attacker to alter the hostname (e.g., via a request like GET @192.168.1.2/) and proxy requests to i...
CVE-2026-48051
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local,...
CVE-2026-48051 Papra: SSRF via HTTP redirect bypass in webhook delivery
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local,...
CVE-2026-64645
The CVE-2026-64645 issue affects Next.js versions 12.0.0–15.5.20 and 16.0.0–16.2.10, where a rewrites() or redirects() rule may build the external destination hostname from request-controlled input. This allows an attacker to proxy a request to an arbitrary host (SSRF) or redirect users to an uni...
CVE-2026-17568
Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...
CVE-2026-54272 ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType classifies an address by matching it against a table of known IPv6...
CVE-2026-54272
The CVE affects the ip-address JavaScript library (versions 10.1.1–10.2.0). A misclassification of IPv4-mapped/NAT64 IPv6 addresses in Address6.getType() caused SSRF and trust-boundary issues by not normalizing mapped addresses to IPv4 before checks, due to the IPv6 special-use prefix table missi...
Security update for libssh
This update for libssh fixes the following issues: CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler bsc1259377. CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. CVE-2026-59844: denial of service via oversized SFTP read...
SUSE-SU-2026:3302-1 Security update for libssh
This update for libssh fixes the following issues - CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler bsc1259377. - CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. - CVE-2026-59844: denial of service via oversized SFTP rea...
Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.
Summary Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced CVE-2026-4410, CVE-2026-5516, CVE-2026-9071, CVE-2026-9320, CVE-2026-8646, CVE-2026-11541, CVE-2026-11806. An update to IBM CICS TX Advanced has been released to address these...
CVE-2026-17192 VeloCloud Orchestrator Missing Input Validation SSRF
A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin. This issue was discovered...
CVE-2026-17192
The CVE-2026-17192 issue affects the VeloCloud Orchestrator (VCO) feature, where caller-supplied input is not sufficiently validated, enabling requests on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. Root cause: inadequate input validation on VCO...
CVE-2026-59921
A flaw was found in Netty's HttpPostRequestEncoder, a widely used Java networking library component responsible for constructing multipart HTTP request bodies. The issue arises because user-supplied filenames and field names are directly embedded into Content-Disposition MIME headers without any...
GO-2026-6068 Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 in gitea.dev
Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR 38145 in gitea.dev...
GO-2026-6084 Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL in gitea.dev
Gitea: SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL in gitea.dev...
GO-2026-6086 Gitea: Public-only repository tokens can update private PR head branches in gitea.dev
Gitea: Public-only repository tokens can update private PR head branches in gitea.dev...
