EUVD-2026-68436

A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/GenericHttpEndpointResolver.php. Such manipulation of the argument endpointurl leads to server-side request forgery. It is possibl...

CVE-2026-82667

This vulnerability affects yaojingang GEOFlow versions up to 2.1.0 . The server-side request forgery (SSRF) is triggered in the function DistributionController.isValidHttpEndpoint within app/Services/GeoFlow/GenericHttpEndpointResolver.php through manipulation of the endpoint_url argument. The at...

WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Adam Kahlon Adkali in WordPress Plugin MapSVG versions = 8.15.0...

UBUNTU-CVE-2026-58301

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...

CVE-2026-58301 Apache Shiro: Server-side POST request may be steered to an alternate host

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...

CVE-2026-82630 PowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection server-side request forgery

A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the component Transport Endpoint. The manipulatio...

CVE-2026-40465

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

CVE-2026-40465

Nokia NSP (Network Service Platform) is vulnerable to an open redirect caused by insufficient server-side validation of the URL or redirect parameter. An attacker can craft a malicious URL that redirects users to an untrusted destination, potentially facilitating phishing attacks. The CVSS 3.1 sc...

CVE-2026-40465 An Open Re-direct Vulnerability in Nokia NSP

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

PT-2026-84031

Unauthenticated Server Side Request Forgery SSRF in MapSVG = 8.15.0 versions...

Important: iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fixes: iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via...

PT-2026-84038

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation...

PT-2026-84035

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 4.5.7 Smarty versions prior to 5.8.2 Description Smarty is a PHP template engine that separates presentation from application logic. A flaw exists in the fetch handling within libs/plugins/function.fetch.php and...

Linux Distros Unpatched Vulnerability : CVE-2026-77310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1,...

CVE-2026-58301

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...

CVE-2026-82556

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...

CVE-2026-82556

Forgejo up to 15.0.4 is affected by a server-side request forgery (SSRF) vulnerability in the Repository Migration Handler . The root cause is the use of net.LookupIP in services/migrations/allowlist/is_migrate_allowed.go, where a remote attacker with low privileges can perform a manipulation to ...

CVE-2026-82556 Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...

EUVD-2026-68214

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

PT-2026-83558

Name of the Vulnerable Software and Affected Versions jina-ai reader affected versions not specified Description The software disables its private-address guard when deployed outside of Google Cloud environments, which enables unauthenticated attackers to perform server-side request forgery SSRF...