CVE-2026-65593 n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n...

EUVD-2026-46450

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...

EUVD-2026-47015

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the imageurl parameter in the chat completions endpoint. An attacker can access internal services and cloud metadata endpoints by supplying a crafted URL that redirects to internal addresses, as...

PT-2026-63351

n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP...

PT-2026-63563

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description A server-side fetch operation involving a request body may return a cached response body from a separate request directed to the same URL but containin...

PT-2026-63562

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description A server-side fetch operation involving a request body may return a cached response body from a different request sent to the same URL but with a...

PT-2026-63560

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Rules configured via rewrites or redirects that construct an external destination hostname using request-controlled input can be manipulated to point t...

Plone 4.3.x < 5.2.5 Multiple Vulnerabilities (HF 20210518)

The version of Plone installed on the remote host is 4.3.x prior to 5.2.5. It is, therefore, affected by the following vulnerabilities: - Plone CMS has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. CVE-2021-3313 -...

PT-2026-63403

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests...

PT-2026-63475

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing...

PT-2026-63470

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description Improper handling of DBPointer objects during BSON serialization the process of converting data into a binary format in the server-side JavaScript engine can lead to internal process memory...

PT-2026-63564

Name of the Vulnerable Software and Affected Versions Next.js versions 14.1.1 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host, leading to...

The vulnerability of the webService() method in the Calculation/Web/Service.php PHP library allows a attacker to perform an SSRF attack.

The vulnerability of the webService method in the Calculation/Web/Service.php PHP library of the PhpSpreadsheet framework is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the grid image processing and uninitialized pixel plane allocation. An attacker can access sensitive heap memory contents by uploading a specially crafted AVIF or HEIC file to a server-side image processor,...

CVE-2026-65318

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

CVE-2026-65317

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...

CVE-2026-47247

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor WordPress, Sharp/libvips,...

CVE-2026-63142 Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery

Incomplete List of Disallowed Inputs CWE-184 in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by t...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-66)

Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery Incomplete List of Disallowed Inputs CWE-184 in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the...