CVE-2026-55183: Missing Authentication for Critical Function

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin , and --rc-serve. A malicious web page opened by a user while the...

CVE-2024-34319: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request...

CVE-2024-34319

The ProPhoenix Law RMS version v2022.2403.3.101 is vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists in the serviceURL parameter, which allows an attacker to send a crafted HTTP request that forces the application server to perform unintended DNS and web requests . No specific ...

CVE-2026-70162: Asymmetric Resource Consumption (Amplification)

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this...

CVE-2026-70162: Asymmetric Resource Consumption (Amplification)

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this...

RHEL 10 : opentelemetry-collector (RHSA-2026:82344)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:82344 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: google.golang.org/grpc: gRPC-Go: Denial of Service via...

RHEL 9 : opentelemetry-collector (RHSA-2026:82342)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:82342 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: google.golang.org/grpc: gRPC-Go: Denial of Service via...

MiracleLinux 9 : opentelemetry-collector-0.158.0-1.el9_8 (AXSA:2026-2023:06)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2023:06 advisory. google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-84445 Tenable has extracted the preceding description block directly...

CVE-2026-109652

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

CVE-2026-19622 IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests...

CVE-2026-19622 IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests...

CVE-2026-19622

IBM Planning Analytics versions 2.0 and 2.1 are vulnerable to an authentication bypass and privilege escalation. The root cause is the improper validation of sub-requests , which allows a remote attacker to bypass security controls. This vulnerability is associated with CWE-288 (Authentication By...

CVE-2026-109652 Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

CVE-2026-109652 Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

CVE-2026-109652 Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

EUVD-2026-97891

Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/link,story,chest,album/id with numeric IDs to overwrite or delete othe...

CVE-2026-25946

Summary An unauthenticated Server-Side Request Forgery SSRF vulnerability in Gitea's OpenID authentication allows any remote attacker to make arbitrary HTTP requests to internal network services. This enables internal port scanning, service fingerprinting, and access to localhost-only resources...

CVE-2026-57143 PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxngsearch and the searchweb SearxNG provider pass the LLM-controlled searxngurl parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the...

CVE-2026-77364

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only duri...

CVE-2026-77364

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only duri...