EUVD-2026-84007

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLEDRAWIOPROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in Utils.sanitizeUrl using one DN...

PT-2026-96057

Name of the Vulnerable Software and Affected Versions RestroPress WordPress plugin versions prior to 3.4.6 Description Insufficient server-side validation of client-supplied item add-on prices occurs when items are added to or updated in the cart. This allows unauthenticated users to manipulate t...

PT-2026-96141

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.91.1 Description The SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go performs an http.Get request on the UnsubscribeURL parameter within the payload. Because the BuildSignature...

CVE-2026-61749: Exposure of Sensitive Information to an Unauthorized Actor

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The...

CVE-2026-94051 0717376 cowork_bench pdf-tools-mcp server.py ControlFlowNode server-side request forgery

A vulnerability was found in 0717376 coworkbench up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d. Affected by this vulnerability is the function ControlFlowNode of the file localservers/pdf-tools-mcp/pdftoolsmcp/server.py of the component pdf-tools-mcp. Performing a manipulation of the argument...

CVE-2026-94040 vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery

A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/app/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may b...

OPENSUSE-SU-2026:21921-1 Security update for chromium

This update for chromium fixes the following issues: Changes in chromium: - Chromium 153.0.8010.52 boo1281123: CVE-2026-93374: Use after free in Dawn CVE-2026-93372: Buffer overflow in WebGL CVE-2026-93375: Incorrect reference resolution in Tracing CVE-2026-93382: Use after free in PDFium...

devarea

DevArea — HackTheBox プラットフォーム: HackTheBox OS: Linux ステータス: リタイア済み — 完全なウォークスルー公開中。 完全なウォークスルー: l3dsec.com/walkthroughs/devarea-htb 攻撃チェーン root@kitploit: nmap → 21 FTP anon + 80 + 8080 Jetty + 8888 Hoverfly → FTP anon → employee-service.jar Apache CXF, pre-3.5.5 → CVE-2022-46364 SSRF →...

CVE-2026-94108: Improper Restriction of XML External Entity Reference

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...

CVE-2026-94109: Improper Neutralization of Special Elements Used in a Template Engine

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the...

GHSA-6623-4Q32-82V8 Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references. Original Description hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a...

Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references. Original Description hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a...

CVE-2026-93981 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

CVE-2026-93981 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

CVE-2026-93981

hono/jsx (a server-side rendering component of the hono web framework) before version 4.13.7 fails to HTML-escape plain strings in several rendering paths: child or fallback of Suspense , string child of ErrorBoundary alongside an async sibling, the single child of Context.Provider , and the root...

CVE-2026-93981: Improper Neutralization of Input During Web Page Generation

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

PT-2026-95818

Name of the Vulnerable Software and Affected Versions hono versions prior to 4.13.7 Description The software fails to HTML-escape plain strings rendered by hono/jsx in specific scenarios: as a child or fallback of Suspense, as a string child of ErrorBoundary when an asynchronous sibling is presen...

PT-2026-105486

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references. Original Description hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a...

WordPress Wow Elements Addons for Elementor plugin <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery vulnerability

Authenticated Contributor+ Server-Side Request Forgery vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Waris Damkham in WordPress Plugin Wow Elements Addons for Elementor versions = 1.11.2...

CVE-2026-93759

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...