32162 matches found
CVE-2026-64900 Microsoft SharePoint Server Spoofing Vulnerability
...
EUVD-2026-56447
Server-side request forgery ssrf in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network...
CVE-2026-65811
CVE-2026-65811 : This entry concerns Power BI with an issue described as improper input validation that allows an authorized attacker to execute code over a network. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8 (HIGH). Affected component and root cause are stated onl...
CVE-2026-65660
A code injection vulnerability exists in Microsoft SharePoint Server (on-premises versions 2016, 2019, and 2022) due to unescaped quote injection into Register directives . This flaw allows an authorized low-privilege user to bypass SafeControls validation and achieve remote code execution (RCE) ...
CVE-2026-65660 Microsoft SharePoint Server Remote Code Execution Vulnerability
...
CVE-2026-65658 Microsoft SharePoint Server Remote Code Execution Vulnerability
...
CVE-2026-65658 Microsoft SharePoint Server Remote Code Execution Vulnerability
...
CVE-2026-64922 Microsoft SharePoint Server Spoofing Vulnerability
...
CVE-2026-62913
CVE-2026-62913 describes a heap-based buffer overflow in Microsoft Exchange Server that allows an authorized attacker to execute code over a network. The CVSS v3.1 base score is 8.8 (HIGH) with NETWORK attack vector, LOW attack complexity, and privileges required: LOW; impact on confidentiality, ...
EUVD-2026-56286
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...
Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery (CVE-2026-14529)
Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery vulnerability when sipServlet-1.1 is enabled. Vulnerability Details CVEID:CVE-2026-14529 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere...
EUVD-2026-56282
CAI Content Credentials is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed...
CVE-2026-47922 CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)
CAI Content Credentials is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed...
CVE-2026-48483 TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server
TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings...
CVE-2026-48483 TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server
TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings...
EUVD-2026-56238
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerable path decrypts the selected workspace...
CVE-2026-51583
An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...
CVE-2026-12074 vulnerabilities
Vulnerabilities for packages: open-webui...
