CVE-2026-76909

The open-source feature management platform Unleash is vulnerable to HTML injection in versions prior to 8.0.3 . The root cause is the use of Mustache triple-stash syntax (e.g., {{{ changeRequestTitle }}}) in the src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache template...

CVE-2026-76710

A vulnerability exists in the Analytics and Location Engine ALE management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful...

CVE-2026-62985

request-filtering-agent is an https.Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or...

Uncaught Exception

Overview request-filtering-agent is an An https.Agent implementation that block request Private IP address. Affected versions of this package are vulnerable to Uncaught Exception via the createConnection method in RequestFilteringHttpAgent and RequestFilteringHttpsAgent, when a blocked IP address...

NPM: request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

NPM: request-filtering-agent: Synchronous throw from createConnection for literal private-IP hosts bypasses req.on'error', crashing the Node.js process vulnerability discovered by ? in WordPress Npm request-filtering-agent versions 3.2.1...

request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

Summary RequestFilteringHttpAgent / RequestFilteringHttpsAgent block requests to private IPs, but the blocking happens via a synchronous throw inside createConnection for literal private-IP hostnames e.g. 169.254.169.254, 127.0.0.1. Node.js's http.request / http.get expects createConnection to em...

GHSA-R3R9-WP5J-PQ5G request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

Summary RequestFilteringHttpAgent / RequestFilteringHttpsAgent block requests to private IPs, but the blocking happens via a synchronous throw inside createConnection for literal private-IP hostnames e.g. 169.254.169.254, 127.0.0.1. Node.js's http.request / http.get expects createConnection to em...

Security Bulletin: Vulnerabilities in WebSphere Liberty profile(CVE-2026-14525, CVE-2026-16192, CVE-2026-10571, CVE-2026-14976, CVE-2026-15280, CVE-2026-18499, CVE-2026-14980, CVE-2026-2482, CVE-2026-14529, CVE-2026-10841) affect Power PowerVM Novalink

Summary The WebSphere Liberty profile used by PowerVM Novalink. Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-10571 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure...

CVE-2026-75743

Adobe Experience Manager Forms JEE is affected by a Cross-Site Request Forgery CSRF vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access, causing a limited disruption to...

EUVD-2026-84679

request-filtering-agent is an https.Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or...

CVE-2026-62985 request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

request-filtering-agent is an https.Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or...

CVE-2026-62985 request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

request-filtering-agent is an https.Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or...

CVE-2026-62985 request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

request-filtering-agent is an https.Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or...

CVE-2026-62985

The request-filtering-agent library (an http(s).Agent implementation) is vulnerable to a denial of service before version 3.2.1 . The RequestFilteringHttpAgent and RequestFilteringHttpsAgent components synchronously throw from createConnection() when rejecting literal private-IP hosts (e.g., 127....

CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-91129

The Home Assistant home automation software is vulnerable to a Server-Side Request Forgery (SSRF) flaw in the IPP integration (specifically within homeassistant/components/ipp/config_flow.py). Prior to version 2026.2.3 , the async_step_zeroconf function automatically processed unauthenticated _ip...

CVE-2026-84395 Premiere Pro | Server-Side Request Forgery (SSRF) (CWE-918)

Premiere Pro is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation potentially resulting in unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2026-93379

A flaw was found in Google Chrome. This incorrect authorization vulnerability in the Object Request Broker ORB component allows a remote attacker to bypass site isolation. By crafting a malicious HTML page, an attacker can exploit this flaw, potentially leading to unauthorized access to sensitive...