CVE-2026-55229 Gotenberg: SSRF via LibreOffice document processing

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms/libreoffice/convert endpoint allows a specially crafted document to cause LibreOffice to automatically retrieve external HTTPS resources and local file resources during document conversion, enabling bli...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

Server-side Request Forgery (SSRF)

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the WebFetchTool.Execute function in the Guarded Web Fetch Flow process. An attacker can make the server initiate arbitrary HTTP requests to internal or external resources by supplying crafted URLs...

ROS-20260710-73-0008

The vulnerability of the Go programming language is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service failures...

ROS-20260710-73-0032

The vulnerability of the Go programming language is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a perpetrator to cause service failures...

ROS-20260710-73-0027

The vulnerability of the Go programming language is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability of the DefaultHttp2FrameReader class in the framework for developing network applications, servers, and clients using the Netty protocol allows a attacker to cause a service failure.

The vulnerability of the DefaultHttp2FrameReader class in the network application development framework for protocols like Netty relates to the distribution of resources without any restrictions or regulation. Exploiting this vulnerability can allow a malicious actor to cause service failures...

ROS-20260710-73-0019

The vulnerability of the Go programming language component tar Reader is related to unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Langflow < 1.9.0 Missing Authorization (CVE-2026-33760)

The version of Langflow installed on the remote host is prior to 1.9.0. It is, therefore, affected by a missing authorization vulnerability: - The /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources without verifying that the...

CVE-2026-57054

A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable. If an MX Series device is...

CVE-2026-57054 Junos OS: MX Series: Web filtering doesn't block specifically formatted URLs

A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable. If an MX Series device is...

CVE-2026-57054

CVE-2026-57054 describes a Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series. The issue allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreacha...

CVE-2026-57054

A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable. If an MX Series device is...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the compile function. An attacker can cause excessive memory consumption by supplying a large comma-separated selector list, leading to process termination or degraded system...

CVE-2026-31984

A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into...

EUVD-2026-42512

The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated media-proxying endpoint, allowing anonymous users to make the site fetch arbitrary URLs, including internal and private-network addresses, and read back...

PT-2026-56987

A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable. If an MX Series device is...

Open Redirect

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Open Redirect via the filefetch function in the /gradioapi/file= endpoint. An attacker can redirect users to arbitrary URLs or access internal...

CVE-2026-60105 Monsta FTP < 2.14.5 SSRF via IPv4-Mapped IPv6 Address Bypass

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obta...