CVE-2026-35548

An issue was discovered in guardsix formerly Logpoint ODBC Enrichment Plugins before 5.2.1 5.2.1 is used in guardsix 7.9.0.0. A logic flaw allowed stored database credentials to be reused after modification of the target Host, IP address, or Port. When editing an existing Enrichment Source,...

PT-2026-34564

Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a Server-Side Request Forgery SSRF vulnerability due to missing SSRF protection on the Jint HTTP client used by scripting engine functions getJSON, request, etc.. An authenticate...

PT-2026-34569

WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the url schema field accepts any string without protocol restriction or destination validation. Attackers who can create or modify integrations can set webhook URLs to internal network...

PT-2026-34550

Name of the Vulnerable Software and Affected Versions Spring Authorization Server affected versions not specified Description A critical flaw in Spring Authorization Server allows for Cross-Site Scripting XSS, Server-Side Request Forgery SSRF, and privilege escalation. Recommendations Disable...

Progress Telerik UI for AJAX code issues and vulnerabilities

Progress Telerik UI for AJAX is a set of Web interface components developed by the American company Progress. Versions of Progress Telerik UI for AJAX from 2024.4.1114 to 2026.1.421 contain code vulnerabilities. These vulnerabilities stem from the RadFilter control’s unsafe deserialization when...

Craft CMS code issues and vulnerabilities

Craft CMS is an open-source content management system CMS developed by Craft Studio. There are code vulnerabilities in Craft CMS, which are caused by attacks that can be exploited through server-side request forgeing. The following versions are affected: from version 4.x to 4.17.8, and from versi...

Xerte Online Toolkits security vulnerabilities

Xerte Online Toolkits is an online learning content creation platform provided by British company Xerte. Versions of Xerte Online Toolkits 3.15 and earlier contained a security vulnerability. This vulnerability stemmed from incomplete input validation at the elFinder connector endpoint, allowing...

PT-2026-37150

Name of the Vulnerable Software and Affected Versions i18next-http-middleware versions prior to 3.9.3 Description An unauthenticated HTTP client can pollute Object.prototype in the Node.js process hosting the middleware. This occurs via two unvalidated entry points: getResourcesHandler and...

WeKan code issues and vulnerabilities

WeKan is an open-source dashboard application developed by WeKan. Versions of WeKan prior to 8.35 contained code vulnerabilities. These vulnerabilities stemmed from the webhook integration URL processing, where the url pattern field allowed any string without protocol restrictions or target...

Squidex code-related vulnerabilities

Squidex is an open-source content management system developed by Squidex. Versions of Squidex prior to 7.23.0 had code vulnerabilities. These vulnerabilities were caused by a server-side request forgeing issue, allowing users with asset upload permissions to force the server to obtain arbitrary...

OpenRemote code issues and vulnerabilities

OpenRemote is an open-source IoT platform developed by OpenRemote. Versions of OpenRemote prior to 1.22.0 contained code vulnerabilities. These vulnerabilities stemmed from the XML parsing process during asset import in Velbus, where the XML external entities were not properly secured. This allow...

Squidex code-related vulnerabilities

Squidex is an open-source content management system developed by Squidex. Versions of Squidex prior to 7.23.0 had code vulnerabilities. These vulnerabilities stemmed from the RestoreController.PostRestoreJob endpoint, which allowed administrators to download backup archives from arbitrary URLs,...

Squidex code-related vulnerabilities

Squidex is an open-source content management system developed by Squidex. Versions of Squidex prior to 7.23.0 had code vulnerabilities. These vulnerabilities stemmed from a lack of server-side request forgery protection in the Jint HTTP client. This could allow authenticated users with low...

PT-2026-37157

Name of the Vulnerable Software and Affected Versions Flarum versions prior to 1.8.16 Flarum versions prior to 2.0.0-rc.1 Description An authenticated administrator can inject an arbitrary @import directive into the compiled forum.css file. This occurs because settings registered as LESS config...

GLPI SSRF

The vulnerability of the GLPI system for managing requests, incidents, and inventory of computer equipment is related to insufficient verification of incoming requests. Exploiting this vulnerability could allow a malicious actor to carry out an SSRF attack remotely...

PT-2026-34572

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blind Server-Side Request Forgery SSRF. The application fails to validate the URI scheme of the user-supplied Url parameter, allowing the use ...

PT-2026-34451

Name of the Vulnerable Software and Affected Versions guardsix ODBC Enrichment Plugins versions prior to 5.2.1 Description A logic flaw exists where stored database credentials are retained after the target Host, IP address, or Port is modified. When editing an Enrichment Source, the system fails...

PT-2026-37153

Name of the Vulnerable Software and Affected Versions i18next-fs-backend versions prior to 2.6.4 Description i18next-fs-backend substitutes the lng and ns options directly into the configured loadPath and addPath templates to read or write files from the disk. Because this interpolation is...

Guardsix ODBC Enrichment Plugins code-related vulnerabilities

Guardsix ODBC Enrichment Plugins are a set of data extension plugins developed by the Danish company Guardsix. Versions of Guardsix ODBC Enrichment Plugins prior to version 5.2.1 contained code vulnerabilities. These vulnerabilities were due to logical flaws that allowed for the reuse of stored...

Linux Distros Unpatched Vulnerability : CVE-2026-35587

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, a Server-Side Request Forgery SSRF vulnerability exists in the Glances ...