CVE-2026-70162: Asymmetric Resource Consumption (Amplification)

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this...

DevTools Suite Compromise Protected Information

The vulnerability in Google Chrome and Microsoft Edge’s DevTools web development tools involves cross-site request forgery. Exploiting this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...

SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:4626-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4626-1 advisory. - CVE-2026-77050: potential denial-of-service in getsupportedlanguagevariant when processing many distinct, very long language codes bsc1284481...

CVE-2026-70162: Asymmetric Resource Consumption (Amplification)

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this...

CVE-2026-109652

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

CVE-2026-19622 IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests...

CVE-2026-19622 IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests...

CVE-2026-19622

IBM Planning Analytics versions 2.0 and 2.1 are vulnerable to an authentication bypass and privilege escalation. The root cause is the improper validation of sub-requests , which allows a remote attacker to bypass security controls. This vulnerability is associated with CWE-288 (Authentication By...

CVE-2026-109652 Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

CVE-2026-109652 Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

CVE-2026-109652 Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

EUVD-2026-97891

Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/link,story,chest,album/id with numeric IDs to overwrite or delete othe...

CVE-2026-25946

Summary An unauthenticated Server-Side Request Forgery SSRF vulnerability in Gitea's OpenID authentication allows any remote attacker to make arbitrary HTTP requests to internal network services. This enables internal port scanning, service fingerprinting, and access to localhost-only resources...

CVE-2026-57143 PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxngsearch and the searchweb SearxNG provider pass the LLM-controlled searxngurl parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the...

CVE-2026-77364

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only duri...

CVE-2026-77364

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only duri...

CVE-2026-85970 Improper XML external entity restriction in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files...

CVE-2026-85970

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to improper XML external entity restriction. The software enables XML external entity processing by default in multiple server paths, which could allow an attacker to use crafted XML to trigger server-side...

CVE-2026-85970 Improper XML external entity restriction in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files...

CVE-2026-102543

Impact For some client-issued requests concerning remote users or remote rooms belonging to a malicious homeserver, Synapse will make federation requests to that malicious homeserver and will forward received errors back to the client. This allows the malicious homeserver to cause the requesting...