GHSA-H7P7-W5GC-XJ3W Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...

EUVD-2026-57907

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

EUVD-2026-57893

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

EUVD-2025-210725

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions...

CVE-2025-62315 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions...

CVE-2025-62315

Technical details of CVE-2025-62315 are not publicly available in the provided documents; monitor for updates.

DEBIAN-CVE-2026-73627

JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...

CVE-2026-73627

JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...

CVE-2026-73627

JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...

CVE-2026-59504

: Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-59504

CWE-602: Client-Side Enforcement of Server-Side Security...

CVE-2026-59504 Priority – CWE-602: Client-Side Enforcement of Server-Side Security

: Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

EUVD-2026-57771

CWE-602: Client-Side Enforcement of Server-Side Security...

CVE-2026-18699

creationtimestamp| type| source ---|---|--- 2026-08-13 04:45:31+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813...

CVE-2026-18694

creationtimestamp| type| source ---|---|--- 2026-08-13 04:45:19+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813...

CVE-2026-46382

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

PT-2026-71492

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions...

PT-2026-71874

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

PT-2026-71580

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

PT-2026-71892

A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is...