SUSE CVE-2026-84292

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...

SUSE CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

CVE-2026-85601: Improper Neutralization of Input During Web Page Generation

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

PT-2026-85501

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Software Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in version 10.3.23 of Jira Software Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows an unauthenticat...

SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Service Management Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in version 10.3.23 of Jira Service Management Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows an...

SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Software Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.5 and a CVSS...

SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Service Management Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.5 and...

SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Software Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.5 and a CVSS...

SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Service Management Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.5 and...

CVE-2026-53728

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

Security Bulletin: MongoDB Enterprised Advanced affected by: Interpretation Conflict (CVE-2026-13676)

Summary There are vulnerabilities in fast-uri-3.1.2.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-13676. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicod...

CVE-2026-53728 Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

CVE-2026-53728 Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

CVE-2026-53728

Medplum , a healthcare developer platform, is vulnerable to authorization code leakage in its external identity provider callback (GET /auth/external). The root cause is that getClientRedirectUri() accepts any redirect URI that prefix-matches a registered value (startsWith), rather than requiring...

CVE-2026-53728 Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.3.1 before Patch 11 and 5.4.0 before Patch 6. Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN...

SSRF (Server-Side Request Forgery) fast-uri Dependency in Bitbucket Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in version 9.4.22 of Bitbucket Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows an unauthenticated...

SSRF (Server-Side Request Forgery) fast-uri Dependency in Bitbucket Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in version 9.4.12 of Bitbucket Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows an unauthenticated...

SSRF (Server-Side Request Forgery) fast-uri Dependency in Bitbucket Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in version 9.4.12 of Bitbucket Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows an unauthenticated...