MGASA-2026-0300 Updated wget packages fix security vulnerabilities

Updated wget packages fix security vulnerabilities: -CVE-2026-58469 Wget incorrectly handled Metalink documents containing a whitespace-only URL. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Mageia 9 and Mageia 10. -CVE-2026-58470 : Wget...

Server-Side Request Forgery (SSRF)

org.apache.camel, camel-dns is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of DNS-related Exchange message headers dns.server, dns.name, dns.domain, etc. that can be passed from inbound HTTP requests, which allows an attacker to manipulate DNS...

Server-Side Request Forgery

Next.js is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of Host-associated headers during Server Action forwards and redirects, allowing attackers to redirect outbound requests to malicious or internal hosts and potentially expose sensitive...

Cache Confusion

Next.js is vulnerable to Cache Confusion. The vulnerability is due to improper caching of server-side fetch responses, where cached response bodies may be reused across requests with different request bodies, allowing confidential data from one request to be exposed to unauthorized users...

Sensitive Information Exposure

Next.js is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper caching of server-side fetch responses for non-UTF-8 request bodies, where different request bodies can share the same cache entry, allowing confidential response data to be exposed to unauthorized...

OmniFaces: Forged combined-resource IDs and related output/push boundaries

Forged combined-resource IDs CombinedResourceInfo accepts a path-derived ID without an authenticity check, inflates it without an output limit, converts it to attacker-selected resource identifiers, and retains unique IDs in an unbounded static cache. In bounded tests, 20,754 encoded bytes...

GHSA-V6W6-358X-2433 Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

Summary Cloudreve exposes two admin node test endpoints under the Admin.Read OAuth scope. These endpoints accept attacker-controlled node definitions and cause Cloudreve to make outbound server-side network requests. This allows an OAuth client authorized only for Admin.Read to trigger operationa...

GHSA-68R5-9HPG-7QW9 OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

The DSMLv2 SOAP gateway opendj-dsml-servlet in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker...

GHSA-HFHX-W8P8-4HC7 Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

Budibase: SSRF via bare fetch in uploadUrl during AI table generation Summary The uploadUrl function in packages/server/src/utilities/fileUtils.ts uses a bare fetchurl call without any SSRF protection. This function is invoked when the AI table generation feature processes LLM-generated attachmen...

GHSA-V42F-V8XC-J435 Budibase: SSRF via DNS rebinding in the REST datasource integration

Summary Budibase's central outbound-fetch guard fetchWithBlacklist prevents SSRF/DNS-rebinding by resolving the target hostname, checking every resolved IP against the blacklist, and pinning the connection to the validated IP. The pin is implemented as a Node https.Agent makePinnedAgent. The fix...

Server-side Request Forgery (SSRF)

Overview @budibase/backend-core is a Budibase backend core libraries used in server and worker Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the REST datasource integration due to improper handling of DNS rebinding protections. An attacker can access...

GHSA-XG5G-26X8-CVF4 Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution

Impact A builder-level user can make Budibase issue server-side HTTP requests to loopback or private-network targets by using DNS rebinding against two outbound fetch paths that are still not pinned to the validated DNS answer. The first path is OpenAPI query import. It validates the supplied...

Server-side Request Forgery (SSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the OpenAPI import and REST query execution processes. An attacker can access internal network resources by exploiting DNS rebinding to bypass outbound fetch...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2026-44907 via react-server-dom-webpack (>=19.0.0, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0, =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.0.4, =2.0.3-next.0 an...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2026-44907 via react-server-dom-webpack (>=19.0.0, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0, =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.0.4, =2.0.3-next.0 an...

Arbitrary Code Injection

Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Arbitrary Code Injection via the TwigView::render process. An attacker can execute arbitrary operating system commands by injecting malicious Twig expressions into mail...

GHSA-74H3-CXQ7-VC5Q Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

Summary An authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside another user's authenticated session. The Socket.IO event-caller geteventcall delivers execute:python / execute:tool events to a client-supplied sessionid after only checking that the sessio...

GHSA-RQJ7-6WRP-6G2G Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

Summary POST /api/v1/images/edit performed no authorization beyond requiring a verified account. Every other image-editing surface in Open WebUI enforces the global image-edit switch and the per-user image-generation permission — the /api/v1/images/generations route, the built-in editimage tool,...

EUVD-2026-42616

Open WebUI: Stored web worker XSS via Pyodide...

GHSA-W28W-GP39-M4P6 Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

Summary The TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. Affected packages - npm...