CVE-2026-56820

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay...

CVE-2026-60962

Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Flow...

CVE-2026-60844

Vulnerability in the Oracle Customer Support product of Oracle E-Business Suite component: Update Service Request. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customer...

GHSA-PRR9-9MP4-5GP2 Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Summary PR 38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members not just public ones of a private organization. Affected Versions = v1.26.4 latest and main branch Root Cause routers/api/v1/org/member.go — ListMembers: // Missing...

CVE-2026-65318

Verba RAG application version 2.1.3 is affected by an unauthenticated server-side request forgery (SSRF) via the WebSocket import endpoint. Attackers can connect to /ws/import_files without authentication and supply arbitrary URLs in the HTMLReader configuration, prompting the backend to issue HT...

EUVD-2026-46421

mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visitpage tool, which only validates the URL protocol without filtering private or reserved IP...

EUVD-2026-46412

lmdeploy's OpenAI-compatible API server contains a server-side request forgery vulnerability that allows unauthenticated attackers to access internal services and cloud metadata endpoints by supplying a crafted imageurl that redirects to internal targets. Attackers can send a POST request to the...

EUVD-2026-46374

Data::ReqRep::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in reqrep.h with openpath, ORDWR | OCREAT, 0666, for both the request-reply and the integer-variant segments. The mode is 0666, so under the...

CVE-2026-65317 Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...

CVE-2026-65057

Keep commit 91c75e0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a...

CVE-2026-47695

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API http.request, http.websocket blocks requests to private network ranges to prevent server-side request forgery SSRF. This protection can be bypassed ...

CVE-2026-47690

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of GITHUBTOKEN with write permissions to the repository. The vulnerable workflow used...

CVE-2026-16318

The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2nalloc instead of s2nrealloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2nalloc zeroes...

Gitea: Two SSRF findings

| --- | --- | | Versions tested | gitea/gitea:1.26.2 digest sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031; gitea/gitea:latest resolves to the same digest at time of writing | | Source review | git checkout v1.26.2 commit 2c749ce | | Reproduction | bash runpoc.sh single...

CVE-2026-8986 Command Injection via Malicious OCPP Server

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station...

CVE-2026-65056 mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering

mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visitpage tool, which only validates the URL protocol without filtering private or reserved IP...

CVE-2026-47690 MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of GITHUBTOKEN with write permissions to the repository. The vulnerable workflow used...

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Summary GetActionsUserRepoPermission models/perm/access/repopermission.go decides whether an Actions task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator — except the collaborative-owner branch, which is missing the !task.IsForkPullRequest guard that i...

GHSA-FJ8V-HJWV-QM88 Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Summary GetActionsUserRepoPermission models/perm/access/repopermission.go decides whether an Actions task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator — except the collaborative-owner branch, which is missing the !task.IsForkPullRequest guard that i...

GHSA-XXJV-752H-3VP2 Gitea: Public-only repository tokens can update private PR head branches

Summary Gitea allows a public-only,write:repository token to update a private pull request head branch through a public base repository route. The vulnerable endpoint is: text POST /api/v1/repos/public-owner/public-repo/pulls/index/update Gitea checks the token's public-only restriction against t...