CVE-2026-65430 Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension

Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability...

CVE-2026-54291 vulnerabilities

Vulnerabilities for packages: kayenta-fips, apicurio-registry-fips, kayenta, airbyte-server-fips, conductor, sonarqube, flyway, conductor-fips, airbyte-server, nacos, traccar, geoserver, nuxeo, keycloak, apicurio-registry, floci, dependency-track, camunda-zeebe, hono, thingsboard, traccar-fips,...

GHSA-J92G-9F8W-J867 vulnerabilities

Vulnerabilities for packages: kayenta-fips, apicurio-registry-fips, kayenta, airbyte-server-fips, conductor, sonarqube, flyway, conductor-fips, airbyte-server, nacos, traccar, geoserver, nuxeo, keycloak, apicurio-registry, floci, dependency-track, camunda-zeebe, hono, thingsboard, traccar-fips,...

Apache OFBiz < 18.12.11 - Remote Code Execution

The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery SSRF id: CVE-2023-51467 info: name: Apache OFBiz 18.12.11 - Remote Code Execution author: your3cho severity: critical description: | The vulnerability allows attackers to bypass...

Jira <8.4.0 - Server-Side Request Forgery

Jira before 8.4.0 is susceptible to server-side request forgery. The /plugins/servlet/gadgets/makeRequest resource contains a logic bug in the JiraWhitelist class, which can allow an attacker to access the content of internal network resources and thus modify data, and/or execute unauthorized...

SAP Memory Pipes (MPI) Desynchronization

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable to request smuggling and request concatenation attacks. An unauthenticated attacker can prepend a victim's request with arbitrary data. This...

PT-2026-64172

Name of the Vulnerable Software and Affected Versions MZ Automation libIEC61850 affected versions not specified Description The software is susceptible to a stack-based buffer overflow, a condition where a program writes more data to a buffer located on the stack than the buffer is allocated to...

PT-2026-63607

Name of the Vulnerable Software and Affected Versions Joomla Extension - regularlabs.com - GeoIP extension affected versions not specified Description MaxMind credentials are leaked through request URLs, leading to a credential leakage issue. Recommendations At the moment, there is no information...

PT-2026-64185

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.4.72 Description A server-side request forgery SSRF issue exists in the '/v1/web/fetch' endpoint. The endpoint accepts a user-controlled url parameter and passes it to an external scraping provider to fetch content...

PT-2026-64153

Name of the Vulnerable Software and Affected Versions swift-nio-http2 versions prior to 1.45.0 Description SwiftNIO HTTP/2 lacks validation for inbound HEADERS frames, allowing control characters such as CR, LF, NUL, and SP to reach an HTTP/1.1 backend via the HTTP/2-to-HTTP/1 codec. This can lea...

PT-2026-64180

Name of the Vulnerable Software and Affected Versions cal.com main branch Description A repository takeover issue exists in the GitHub Actions workflows. The pr.yml workflow utilizes the pull request target trigger with default write permissions, which are passed to check-types.yml. This second...

PT-2026-63614

The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens...

NPM: Next.js: Server-Side Request Forgery in Server Actions on custom servers

NPM: Next.js: Server-Side Request Forgery in Server Actions on custom servers vulnerability discovered by ? in WordPress Npm next versions = 14.1.1, 15.5.21...

Next.js: Server-Side Request Forgery in Server Actions on custom servers

Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forgery. This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtai...

GHSA-68G3-V927-F742 Next.js: Cache confusion of response bodies for requests with bodies

Impact A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to...

GHSA-4C39-4CCG-62R3 Next.js: Unbounded Server Action payload in Edge runtime

Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be...

EUVD-2024-55651

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests...

EUVD-2026-43646

Eclipse Jetty: HTTP Authority/Host mismatch...

EUVD-2026-43645

Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections...

Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections

Description FINDING — MEDIUM HTTP/1.1 keep-alive connections with trailers HttpConnection.trailers Cross-Request Leakage Never Reset Between Requests Location: jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/ HttpConnection.java:107, 1157-1161, 1170 Detail: trailers line 1...