PT-2026-64809

Name of the Vulnerable Software and Affected Versions openclaw-cn versions prior to 0.2.2 Description An issue exists in the Browser Control HTTP API component within the clickViaPlaywright function located in the src/browser/routes/agent.act.ts file. A remote attacker can perform a manipulation...

MGASA-2026-0300 Updated wget packages fix security vulnerabilities

Updated wget packages fix security vulnerabilities: -CVE-2026-58469 Wget incorrectly handled Metalink documents containing a whitespace-only URL. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Mageia 9 and Mageia 10. -CVE-2026-58470 : Wget...

Server-Side Request Forgery

Next.js is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of Host-associated headers during Server Action forwards and redirects, allowing attackers to redirect outbound requests to malicious or internal hosts and potentially expose sensitive...

EUVD-2026-44937

Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref...

CVE-2026-57106

Server-side request forgery ssrf in Data Quality allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-57106

Server-side request forgery ssrf in Data Quality allows an unauthorized attacker to elevate privileges over a network...

SUSE-SU-2026:3245-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2026-7210: insufficient entropy used for Expat hash-flooding protection allows a crafted XML document to trigger hash flooding bsc1264962. - CVE-2026-8328: server-supplied PASV host address is trusted by ftpcp and allows for SSRF bsc126526...

OESA-2026-3152 wget security update

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc. Security Fixes: GNU Wget does n...

WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin AffiliateX versions = 2.3.5...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-11714 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3...

EUVD-2026-48451

Server-side request forgery ssrf in Azure AI Search allows an authorized attacker to elevate privileges over a network...

CVE-2026-56167

Server-side request forgery ssrf in Azure AI Search allows an authorized attacker to elevate privileges over a network...

EUVD-2026-48435

9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...

SUSE SLES12 Security Update : wget (SUSE-SU-2026:3205-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3205-1 advisory. This update for wget fixes the following issues - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side reques...

SUSE SLES15 Security Update : wget (SUSE-SU-2026:3206-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3206-1 advisory. - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. -...

CVE-2026-56167

Server-side request forgery ssrf in Azure AI Search allows an authorized attacker to elevate privileges over a network...

CVE-2026-63313

9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...

CVE-2026-21653

Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0...

CVE-2026-63313

9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...

CVE-2026-63313 9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch

9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...