CVE-2026-12037 Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

EUVD-2026-86575

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2026-12037 Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2026-97731

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

CVE-2026-97731

Versions of MinIO through 7aac2a2 and pgsty/silo before 1233254 are vulnerable to a security flaw where the system fails to verify if all received x-amz-* headers are present in the client-supplied X-Amz-SignedHeaders list. Specifically, the extractSignedHeaders() function in cmd/signature-v4-uti...

EUVD-2026-86510

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

Hitachi Pentaho Business Analytics Server - Remote Code Execution

Hitachi Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x, is susceptible to remote code execution via server-side template injection. Certain web services can set property values which contain Spring templates that are interpreted downstream, thereby...

The vulnerability of the server-side JavaScript engine of the MongoDB database management system allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the server-side JavaScript engine of the MongoDB database management system is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

PT-2026-98380

Name of the Vulnerable Software and Affected Versions Asset CleanUp: Page Speed Booster versions prior to 1.4.0.6 Description Server-Side Request Forgery occurs via the page url parameter. Authenticated attackers with administrator-level access or higher can initiate web requests to arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2026-79310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that...

RockyLinux 10 : cockpit-image-builder (RLSA-2026:71543)

The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:71543 advisory. fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding CVE-2026-75899 fast-uri: fast-uri: Server-side request forgery v...

CVE-2026-97326

A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java of the component chat-server. This manipulation causes...

EUVD-2026-51596

Contao: Server-Side Request Forgery SSRF via Unvalidated RSS Feed URL in Feed Reader Module...

CVE-2026-97326 songxinjianqwe Chat chat-server ChatServer.java server-side request forgery

A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java of the component chat-server. This manipulation causes...

CVE-2026-97326

A server-side request forgery (SSRF) vulnerability exists in the chat-server component of songxinjianqwe Chat (up to commit ac63d25297079eed5e4ba7e88d3b7a032637150d). The flaw is located within an unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.jav...

EUVD-2026-86449

A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java of the component chat-server. This manipulation causes...

CVE-2026-97326 songxinjianqwe Chat chat-server ChatServer.java server-side request forgery

A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java of the component chat-server. This manipulation causes...

CVE-2026-97320

A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side...

CVE-2026-77294

TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llmbaseurl through the settings API when the LLMPARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted impo...

WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery vulnerability

Authenticated Administrator+ Server-Side Request Forgery vulnerability discovered by Pham Duc Anh in WordPress Plugin Asset CleanUp: Page Speed Booster versions = 1.4.0.5...