metabadger

Metabadger Prevent SSRF attacks on AWS EC2 via automated upgrades to the more secure Instance Metadata Service v2 IMDSv2. Metabadger Purpose and functionality Diagnose and evaluate your current usage of the AWS Instance Metadata Service along with understanding how the service works Prepare you t...

CVE-2026-19678

A server-side request forgery SSRF vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form...

EUVD-2026-108562

A server-side request forgery SSRF vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form...

CVE-2026-19678

A server-side request forgery (SSRF) vulnerability exists in the unauthenticated form service of onPhase Forms version 11.0.14 . An unauthenticated remote attacker can exploit this by providing an attacker-controlled URL to a publicly accessible form, potentially leading to the disclosure of sens...

CVE-2026-114620

A flaw was found in Authlib. A remote attacker can trigger Server-Side Request Forgery SSRF by submitting an unvalidated request URI parameter in an authorization request. Because the library forwards client-supplied addresses to internal retrieval handlers without enforcing destination policies ...

EUVD-2026-108538

Server-side request forgery ssrf in Azure AI Foundry allows an authorized attacker to elevate privileges over a network...

PT-2026-122233

Name of the Vulnerable Software and Affected Versions MLflow versions 3.12.0rc0 through 3.16.x Description An unauthenticated attacker can force the tracking server to make an outbound HTTP request to an arbitrary host, including internal services or cloud-metadata endpoints, with...

PT-2026-122143

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The...

PT-2026-122152

Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file...

SolarWinds Observability Self-Hosted < 2026.4 Multiple Vulnerabilities

The version of SolarWinds Observability Self-Hosted installed on the remote host is prior to 2026.4. It is, therefore, affected by multiple vulnerabilities: - A broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions...

Debian dsa-6579 : roundcube - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6579 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6579-1 [email protected] https://www.debian.org/securit...

Linux Distros Unpatched Vulnerability : CVE-2026-114620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticate...

CVE-2026-114730

Fix SSRF filter islocalurl bypass via NAT64 64:ff9b::/96...

CVE-2021-26855

CVE-2021-26855 CVE-2021-26855, also known as Proxylogon, is a server-side request forgery SSRF vulnerability in Exchange that allows an attacker to send arbitrary HTTP requests and authenticate as the Exchange server. According to Orange Tsai, the researcher who discovered the vulnerabilities,...

DEBIAN-CVE-2026-114620

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled requesturi parameter to the abstract getrequestobject hook before applying a destination or registration policy; the...

CVE-2026-114620

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled requesturi parameter to the abstract getrequestobject hook before applying a destination or registration policy; the...

CVE-2026-108456

Server-side request forgery ssrf in Azure AI Foundry allows an authorized attacker to elevate privileges over a network...

CVE-2026-108456

A Server-Side Request Forgery (SSRF) vulnerability exists in Azure AI Foundry . This flaw allows an authorized attacker to elevate privileges over a network. The vulnerability has a High severity rating (CVSS 3.1 score of 7.7) and requires low privileges to exploit. While the impact is high regar...

CVE-2026-114620 Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled requesturi parameter to the abstract getrequestobject hook before applying a destination or registration policy; the...

CVE-2026-114620

The Authlib Python library (prior to version 1.9.0 ) is vulnerable to Server-Side Request Forgery (SSRF) in its RFC 9101 JWT-secured authorization request (JAR) implementation. The root cause is that the JWTAuthenticationRequest class forwards an unauthenticated, client-controlled request_uri par...