23089 matches found
CVE-2026-94039
vas3k TaxHacker (versions up to 0.8.5 ) is affected by a server-side request forgery (SSRF) vulnerability in the Invoice PDF Renderer component. The root cause is an unvalidated businessLogo argument in the generateInvoicePDF function located at /apps/invoices/actions.ts, which allows a remote at...
CVE-2026-94038 NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery
A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component Deno Backend. Such manipulation of the argument supabaseurl leads to server-side request forgery. The attack can be executed remotely. The...
CVE-2026-94038 NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery
A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component Deno Backend. Such manipulation of the argument supabaseurl leads to server-side request forgery. The attack can be executed remotely. The...
EUVD-2026-83754
A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component Deno Backend. Such manipulation of the argument supabaseurl leads to server-side request forgery. The attack can be executed remotely. The...
CVE-2026-94038
NonceGeek dim-sum-app is vulnerable to server-side request forgery (SSRF) in the Deno Backend component, specifically in the textSearchV2Handler function within deno/main.tsx. The root cause is unsanitized manipulation of the supabase_url argument, allowing a remote, unauthenticated attacker to f...
CVE-2026-94028
A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...
CVE-2026-94028 mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery
A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...
CVE-2026-94028 mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery
A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...
CVE-2026-94028
Mealie (mealie-recipes) versions up to 3.25.1 contain a server-side request forgery (SSRF) vulnerability in the Recipe Action Trigger component, specifically in the payload.model_dump function within mealie/routes/households/controller_group_recipe_actions.py. A remote attacker with low privilege...
CVE-2026-94028 mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery
A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...
EUVD-2026-83742
A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...
CVE-2026-94108
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...
DEBIAN-CVE-2026-94108
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...
CVE-2026-94108
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...
UBUNTU-CVE-2026-94108
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...
EUVD-2026-83728
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...
CVE-2026-94108 getID3 through 1.9.26 XML External Entity Injection via XML2array
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...
CVE-2026-94108
getID3 (PHP library) versions through 1.9.26 are affected by an XML External Entity (XXE) injection in the XML2array helper function. The root cause is that entity loading is not properly disabled when running on PHP before 8.0 . An attacker can craft malicious XML metadata in media files to disc...
CVE-2026-94108 getID3 through 1.9.26 XML External Entity Injection via XML2array
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...
CVE-2026-94108 getID3 through 1.9.26 XML External Entity Injection via XML2array
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...