CVE-2026-71312

A flaw was found in rclone, a command-line program for syncing files. This vulnerability allows a remote attacker to execute arbitrary commands on the server when processing SFTP paths. By crafting a malicious filename that uses specific Unicode single-quote characters, an attacker can bypass...

CVE-2026-19000 JeecgBoot Anonymous Chat Attachment send server-side request forgery

A vulnerability was identified in JeecgBoot up to 3.9.2. The affected element is an unknown function of the file /airag/chat/send of the component Anonymous Chat Attachment Parser. The manipulation leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly...

EUVD-2026-53713

A vulnerability was identified in JeecgBoot up to 3.9.2. The affected element is an unknown function of the file /airag/chat/send of the component Anonymous Chat Attachment Parser. The manipulation leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly...

CVE-2026-19000

CVE-2026-19000 affects JeecgBoot up to version 3.9.2. The vulnerability resides in the Anonymous Chat Attachment Parser component, specifically the /airag/chat/send function, enabling server-side request forgery (SSRF). The attack is network-based, requires no user interaction or privileges, and ...

CVE-2026-19000 JeecgBoot Anonymous Chat Attachment send server-side request forgery

A vulnerability was identified in JeecgBoot up to 3.9.2. The affected element is an unknown function of the file /airag/chat/send of the component Anonymous Chat Attachment Parser. The manipulation leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

CVE-2026-18973

A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

EUVD-2026-53677

A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegmentencode validates only the standalone segment length via FileSegmentGetMaxDataSize and does not verify the residual capacity of the current ASDU frame befo...

CVE-2026-18973

The CVE-2026-18973 entry concerns heshengtao super-agent-party (

CVE-2026-18973 heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery

A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...

EUVD-2026-53694

A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...

CVE-2026-18973

A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...

PT-2026-68646

Name of the Vulnerable Software and Affected Versions Premium SEO WordPress plugin affected versions not specified Description The Premium SEO WordPress plugin is malicious and contains an unauthenticated backdoor. This backdoor allows an unauthenticated attacker to create a hidden administrator...

CVE-2026-14812: Hidden Functionality

The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker...

CVE-2026-48079: Insufficient Session Expiration

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...

PT-2026-68366

Name of the Vulnerable Software and Affected Versions heshengtao super-agent-party versions prior to 0.4.2 Description Remote attackers can trigger server-side request forgery SSRF by manipulating the url argument within the sanitize proxy url function located in the server.py file of the extensi...

CVE-2026-71316

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for //payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +79 more potentially affected by CVE-2026-71321 via nuxt (>=3.1.2, <=3.21.8)

nuxt NPM version =3.1.2, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.1.3, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =10.0.2-rc.4 and more Source cves: CVE-2026-71321 Source advisory: SNYK:JS-NUXT-18565112...

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When vue.runtimeCompiler: true is enabled off by default and the application has a server island component that forwards props into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can inject a...