Security Bulletin: IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [CVE-2026-17262, CVE-2026-18869]

Summary IBM i is vulnerable to a denial of service and security restriction bypass due to improper validation of commands CVE-2026-17262, CVE-2026-18869 in File Transfer Protocol FTP as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17262 DESCRIPTION: IBM i...

Server-side Request Forgery (SSRF)

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the userconfig request parameter. An attacker can make the server initiate requests to arbitrary internal or external hosts by supplyin...

Server-side Request Forgery (SSRF)

Overview org.graylog2:graylog2-server is a log management platform. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the outbound URL handling in HTTPJSONPathDataAdapter in...

CVE-2026-92804

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potential...

CVE-2026-92789

Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup table or event notification permissions can craft allowlisted endpoints that redirect to internal services, enabling the server ...

CVE-2026-92775

Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the serv...

CVE-2026-92527

A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbackscontroller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the...

CVE-2026-76425

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could...

CVE-2025-56563

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

CVE-2026-92815 changedetection.io through 0.60.6 SSRF via browser-step Goto URL

changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optionalvalue parameter to retrieve responses from restricted network locations...

CVE-2026-92815 changedetection.io through 0.60.6 SSRF via browser-step Goto URL

changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optionalvalue parameter to retrieve responses from restricted network locations...

CVE-2026-92815 changedetection.io through 0.60.6 SSRF via browser-step Goto URL

changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optionalvalue parameter to retrieve responses from restricted network locations...

CVE-2026-92815

changedetection.io through 0.60.6 is vulnerable to an unauthenticated SSRF via the browser-step Goto URL action. The root cause is that the SSRF guard is only applied to the main watch URL and is bypassed in browser step Goto URLs, allowing attackers to supply arbitrary internal URLs in the optio...

EUVD-2026-81071

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to...

CVE-2026-92813 Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to...

CVE-2026-92813

Metabase (through 0.63.18 ) is vulnerable to a Server-Side Request Forgery (SSRF) caused by improper validation of the unspecified address 0.0.0.0 in custom GeoJSON URLs . An unauthenticated attacker can save a malicious GeoJSON entry using 0.0.0.0 and trigger server-side requests that reach loop...

CVE-2026-92813 Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to...

CVE-2026-92813 Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to...

CVE-2026-92804 Nango through 0.70.4 Server-Side Request Forgery via Configuration

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potential...

EUVD-2026-81064

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potential...