CVE-2026-95680

IBM WebSphere Application Server versions 8.5 and 9.0 are affected by an improper authentication vulnerability (CWE-287 ). This flaw could allow an authenticated attacker to bypass authorization, potentially leading to administrative impersonation across the cell. To remediate this, IBM recommend...

CVE-2026-103499

IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption (CWE-400). This flaw allows a remote, unauthenticated attacker to exhaust system resources. Affected Products and Versions: WebSphe...

CVE-2026-109954

Parse Server versions 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 are vulnerable to a race condition (CWE-362) where transactional batch state is shared across concurrent requests. This allows a client's transactional batch request to interfere with other clients' database writes. On Post...

CVE-2026-109954

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients'...

CVE-2026-109954 Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients'...

CVE-2026-109405

A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafkarequest.bootStrapServers resul...

CVE-2026-109403

A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the...

CVE-2026-65101

The NVIDIA AIStore for Linux software contains a vulnerability within its distributed sort component . An attacker can trigger a Server-Side Request Forgery (SSRF) by providing a specially crafted external key map URL . Successful exploitation of this flaw may result in information disclosure . N...

CVE-2026-109405

A security flaw in conductor-oss conductor (up to version 3.33.0-rc10 ) allows for Server-Side Request Forgery (SSRF) . The vulnerability exists in the KafkaPublishTask.start function located at kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. By manipulating ...

CVE-2026-109405 conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery

A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafkarequest.bootStrapServers resul...

CVE-2026-109404

A server-side request forgery (SSRF) vulnerability exists in conductor-oss conductor versions up to 3.33.0-rc10 . The flaw originates from an unspecified functionality within the AgentController.java file, specifically located in the Agentspan Agent Runtime component. This vulnerability allows fo...

CVE-2026-109403

The conductor-oss conductor software (up to version 3.32.5 ) is vulnerable to Server-Side Request Forgery (SSRF) in the Agent Card Fetching component. The flaw exists within the A2AService.getAgentCard function located in the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java...

CVE-2026-109403 conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery

A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the...

CVE-2026-109402 conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery

A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulation of the argument mcpServer results in server-side reques...

CVE-2026-109402

A server-side request forgery (SSRF) vulnerability exists in conductor-oss conductor version 3.22.0 . The flaw is located within the MCP Service component, specifically in the MCPService.listTools function found in the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java. An at...

CVE-2026-109246

A flaw was found in FreeRDP. An authenticated client can trigger a Denial of Service DoS by sending a specially crafted frame acknowledgment message to the shadow server. Due to missing input validation on the frame identifier, an arithmetic error causes a divide-by-zero condition. This terminate...

CVE-2026-109190 conductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgery

A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads to server-side request forgery. The attack is possible to be...

CVE-2026-109190

A server-side request forgery (SSRF) vulnerability exists in conductor-oss conductor version 3.31.2 . The flaw is located within the API Tool Configuration component, specifically affecting the ListApiToolsTask.start function in the ListApiToolsTask.java file. An attacker can trigger the SSRF rem...

CVE-2021-42013

CVE-2021-42013 — PoC: Path Traversal + RCE via modcgi patch bypass For use only in controlled and own environments. Do not use against systems without authorization. Description PoC developed to demonstrate CVE-2021-42013 , present in Apache HTTP Server 2.4.50. This CVE is the bypass of the patch...

CVE-2026-89205

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly perform server-side authorization checks for requests to schedule special operations. This could allow an authenticated attacker with minimal privileges to schedule unauthorized operation...