CVE-2026-63107

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use...

CVE-2026-63769

Huginn (up to version 2022.08.18) is affected by a server-side request forgery in the fetch_url method of ScenarioImport. The vulnerability allows authenticated users to submit crafted URLs that cause arbitrary HTTP requests, enabling probing of internal networks, port enumeration via error signa...

CVE-2026-63769 Huginn < 2026.09.09 SSRF via ScenarioImport fetch_url Method

Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetchurl method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, a...

CVE-2026-63769 Huginn < 2026.09.09 SSRF via ScenarioImport fetch_url Method

Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetchurl method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, a...

CVE-2026-63731

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...

CVE-2026-63731 HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...

CVE-2026-63730 HyperDX < 2.31.0 SSRF via Webhook Test Endpoint

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficie...

CVE-2026-63730

HyperDX

CVE-2026-63107 LimeSurvey SSRF via REST API Survey Template Host Header

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use...

EUVD-2026-46061

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use...

CVE-2026-63107

LimeSurvey (versions up to 6.17.10 and 7.0.4) contains a server-side request forgery in the REST API survey template endpoint. The vulnerability arises from unsanitized use of the HTTP Host header in getTemplateData(), allowing authenticated users to cause the server to issue arbitrary HTTP reque...

opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage

A flaw was found in OpenTelemetry Java, specifically within the baggage propagation implementation of opentelemetry-api and opentelemetry-extension-trace-propagators. A remote attacker can exploit this vulnerability by sending oversized baggage, which leads to unbounded memory allocation and high...

MAL-2026-10871 Malicious code in @azure-lab-services/ml-ts (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @azure-lab-services/ml-ts (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in kimichat (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b57c88bce76fccb6cb2b3a99ef53a62402a8d56b4918ba4c7f2b634036317093 The package presents itself as a 'Python wrapper for the bundled kimichat runtime' and exposes a kimichat-run console script plus kimichat.run...

PT-2026-61689

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficie...

Important: sssd security update

The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch NSS and the Pluggable Authentication Modules PAM interfaces toward the system, and a pluggable back-end system ...

PT-2026-61687

Name of the Vulnerable Software and Affected Versions LimeSurvey versions 6.x through 6.17.10 LimeSurvey versions 7.x through 7.0.4 Description Authenticated users can trigger a server-side request forgery SSRF by providing a manipulated Host header. This occurs due to the unsanitized use of the...

Cisco ASA/FTD Web Services Infinite Loop (CVE-2024-20353)

A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service DoS condition. This...

Cisco ASA/FTD WebVPN/AnyConnect Improper Input Validation (CVE-2020-3452)

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability i...