PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion

...

Server-Side Request Forgery

esm.sh is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation in the /https fetch route, where localhost and internal network protections rely on hostname string checks that can be bypassed using DNS alias domains, allowing attackers to induce...

GHSA-RC8C-94M4-FRFH vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-gcp, linux-azure, linux-qemu...

CVE-2026-43100 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-gcp, linux-azure, linux-qemu...

GHSA-H53C-6597-VMFW vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-gcp, linux-azure, linux-qemu...

GHSA-JG3H-4JH8-MFWR vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-gcp, linux-azure, linux-qemu...

CVE-2026-31609 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-gcp, linux-azure, linux-qemu...

CVE-2026-31592 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-gcp, linux-azure, linux-qemu...

CVE-2026-43109 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-gcp, linux-azure, linux-qemu...

GHSA-R5QW-5M8Q-6774 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-gcp, linux-azure, linux-qemu...

GHSA-585P-9MG2-6VMM vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-gcp, linux-azure, linux-qemu...

GHSA-463M-22HH-CHVM vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-gcp, linux-azure, linux-qemu...

CVE-2021-47958

CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files. Attackers can upload SVG files containing external entity references through the browse.php endpoint to access internal service...

CVE-2026-45009

CVE-2026-45009 affects phpMyFAQ prior to 4.1.2. The issue is an insufficient authorization check in admin-api routes, allowing authenticated ordinary users to access administrative endpoints without verifying backend privileges. This can expose sensitive backend information such as dashboard vers...

CVE-2021-47958

CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files. Attackers can upload SVG files containing external entity references through the browse.php endpoint to access internal service...

EUVD-2021-34813

CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files. Attackers can upload SVG files containing external entity references through the browse.php endpoint to access internal service...

Server-side Request Forgery (SSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the req function. An attacker can access internal services and sensitive cloud metadata by leveraging HTTP redirects through an attacker-controlled server,...

Server-side Request Forgery (SSRF)

Overview @budibase/backend-core is a Budibase backend core libraries used in server and worker Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the req function. An attacker can access internal services and sensitive cloud metadata by leveraging HTTP...

GHSA-FGQV-JH4G-PVG2 Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration

Summary The REST datasource integration follows HTTP redirects without re-checking the IP blacklist, allowing an authenticated Builder to access internal services cloud metadata, databases by redirecting through an attacker-controlled server. The same vulnerability class was already patched in...

Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration

Summary The REST datasource integration follows HTTP redirects without re-checking the IP blacklist, allowing an authenticated Builder to access internal services cloud metadata, databases by redirecting through an attacker-controlled server. The same vulnerability class was already patched in...