AlmaLinux 9.2 [TuxCare] Security Update: libuv / libuv-devel / libuv-static (ALMALINUX9.2:CLSA-2025:1762363908)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762363908 advisory. - libuv is a multi-platform support library with a focus on asynchronous I/O. The uvgetaddrinfo function in src/unix/getaddrinfo.c and its...

PT-2026-103825

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables...

PT-2026-105820

Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validated addresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not is global. That check is...

PT-2026-105916

In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to...

CVE-2026-103291: Server-Side Request Forgery (SSRF)

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network...

Linux Distros Unpatched Vulnerability : CVE-2026-102577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user...

Rocky Linux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1777946314)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777946314 advisory. - Server-Side Request Forgery SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server v...

Rocky Linux 8 [CIQ] Security Update: httpd / httpd-debuginfo / httpd-debugsource / httpd-devel / etc Multiple Vulnerabilities (crlsa-2024_4720)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20244720 advisory. httpd: Encoding problem in modproxy CVE-2024-38473 httpd: Substitution encoding issue in modrewrite CVE-2024-38474 httpd: Improper escaping of output in...

CentOS Linux 7 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-python / libxml2-static Multiple Vulnerabilities (CENTOS7:CLSA-2026:1789553486)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1789553486 advisory. - In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write...

CVE-2026-100251: Server-Side Request Forgery (SSRF)

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP...

CVE-2026-103530: Server-Side Request Forgery (SSRF)

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...

PT-2026-105879

Impact OpenCVE contains a Server-Side Request Forgery SSRF vulnerability in the notification testing functionality for both Webhook and Slack integrations. An authenticated user with permission to configure notification channels can trigger test requests to arbitrary HTTPS endpoints. Insufficient...

Rocky Linux 8 [CIQ] Security Update: libuv / libuv-debuginfo / libuv-debugsource / libuv-devel (crlsa-2024_4247)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20244247 advisory. libuv: Improper Domain Lookup that potentially leads to SSRF attacks CVE-2024-24806 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_55603)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202655603 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...

Rocky Linux 10.2 [CIQ] Security Update: nodejs24 / nodejs24-debuginfo / nodejs24-debugsource / etc Multiple Vulnerabilities (crlsa-2026_58819)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202658819 advisory. brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand function CVE-2026-14257 ip-address: ip-address: Server-Side Request...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_54371)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654371 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_54530)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654530 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...

Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_55601)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202655601 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...

CVE-2026-103530

The decolua 9Router software (up to version 0.5.55 ) is vulnerable to a server-side request forgery (SSRF) . The flaw exists within the fetch function of the src/shared/utils/ssrfGuard.js file, specifically located in the Search Endpoint component. An attacker can initiate this attack remotely by...

Astro: Netlify Image CDN allowlist bypass enables SSRF

Summary The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test, so an allowed image origin appearing anywhere in a URL, including its path or...