EUVD-2026-87839

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

CVE-2026-100848

AzuraCast versions before 0.23.8 (specifically the azuracast/azuracast Composer package) are vulnerable to Server-Side Request Forgery (SSRF) . The root cause is that the software validates the "Remote Relay" URL only for syntax and scheme (http/https) via Utilitiesase\Urls::parseUserUrl, but fa...

CVE-2026-100848 AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL

AzuraCast Composer package azuracast/azuracast before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri and performs no host or IP address restriction. A user holding only the station-scope...

CVE-2026-100848 AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL

AzuraCast Composer package azuracast/azuracast before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri and performs no host or IP address restriction. A user holding only the station-scope...

CVE-2026-100848 AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL

AzuraCast Composer package azuracast/azuracast before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri and performs no host or IP address restriction. A user holding only the station-scope...

PT-2026-99552

Name of the Vulnerable Software and Affected Versions Citrix NetScaler ADC versions prior to 14.1-73.37 Citrix NetScaler ADC versions prior to 13.1-64.23 Citrix NetScaler ADC versions prior to 14.1-73.37 FIPS Citrix NetScaler ADC versions prior to 13.1-37.279 Citrix NetScaler ADC NDcPP affected...

CVE-2026-88773: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of HTTP requests 'HTTP Request/Response smuggling' vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIP...

PT-2026-99469

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description Insufficient URL validation in the getValidUrl function within the AbstractConnector.php file allows for server-side request forgery. The validation process only rejects literal link-local IP...

Linux Distros Unpatched Vulnerability : CVE-2026-100666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each...

Linux Distros Unpatched Vulnerability : CVE-2026-100697

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin plugins/drivers/clickhouse.php, rewritten in 6.0.0 is loaded, is vulnerable to...

NetScaler ADC and NetScaler Gateway 13.1 < 13.1-64.23 / 14.1 < 14.1-73.37 Multiple Vulnerabilities

The remote NetScaler ADC formerly Citrix ADC or NetScaler Gateway formerly Citrix Gateway device is version 13.1 prior to 13.1-64.23, 14.1 prior to 14.1-73.37, 13.1-FIPS/NDcPP prior to 13.1-37.279, or 14.1-FIPS prior to 14.1-73.37. It is, therefore, affected by multiple vulnerabilities: - A remot...

CVE-2026-101048: Incorrect Authorization

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

drupalgeddon2-cve-lab

Drupalgeddon2 CVE-2018-7600 ラボ このリポジトリは、Drupalgeddon2 実行用の再利用可能なターゲットパッケージです。 Sentinel は 2026-08-27 に、SQLite と PHP 7.4 を搭載した Drupal core 7.57 に対して CVE-2018-7600 を再現しました。このエクスプロイトは、Drupal 7 の 2 リクエスト AJAX レンダー配列パスです: 1. namepostrender=passthru、namemarkup=id、nametype=markup...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in its HTTP/3 request header handling, which does not enforce the RFC 9114 section 4.3.1 requirement that an :authority pseudo-header and a literal host header field carry the same value when both are present. An...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in HttpConversionUtil.toHttp3HeadersHttpMessage, boolean, which has no special case for HTTP/1 CONNECT and instead runs the generic request conversion, drawing :authority from the Host header rather than the...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in HttpConversionUtil.toHttp3HeadersHttpMessage, boolean, reached through Http3FrameToHttpObjectCodecfalse, which processes the Host header before the authority carried in an absolute-form request-target, so a...

HTTP Request Smuggling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling in the isContentAlwaysEmpty method of HttpServerCodec, which calls...

CVE-2026-100712

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

CVE-2026-100705

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

CVE-2026-100697

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin plugins/drivers/clickhouse.php, rewritten in 6.0.0 is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit authdriver=clickhouse with authserver set to an arbitrary U...