CVE-2026-92804: Server-Side Request Forgery (SSRF)

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potential...

PT-2026-93278

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remot...

CVE-2026-65388: URL Redirection to Untrusted Site

A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0...

CVE-2026-61559 @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable ENABLEDYNAMICAPIURL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab A...

CVE-2026-61559 @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable ENABLEDYNAMICAPIURL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab A...

CVE-2026-61559 @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable ENABLEDYNAMICAPIURL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab A...

CVE-2026-61559

@zereight/mcp-gitlab (a Model Context Protocol server for GitLab) is vulnerable to Server-Side Request Forgery in versions 0.0.1 through

EUVD-2026-80004

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable ENABLEDYNAMICAPIURL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab A...

@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft Affected - Repository: zereight/gitlab-mcp - Affected versions: All versions through commit 74a8c83 - Patched versions: None at time of report Severity High. CVSS v3.1 8.5 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Descripti...

GHSA-2H44-8472-FRJJ @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft Affected - Repository: zereight/gitlab-mcp - Affected versions: All versions through commit 74a8c83 - Patched versions: None at time of report Severity High. CVSS v3.1 8.5 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Descripti...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the ResourceService and WebjarService when percent-encoded slash or backslash separators in URL path segments are decoded. An attacker can access resources outside the configured base directory by crafting reques...

CVE-2026-76820

OpenCTI, an open-source cyber threat intelligence platform, is affected by a Server-Side Request Forgery (SSRF) in the synchronizerFetch GraphQL query prior to version 7.260701.0 . The backend's fetchRemoteStreams function validated only the HTTP/HTTPS scheme without applying the ingestion deny l...

CVE-2026-76820 OpenCTI: Synchronizer SSRF: stream fetch has no URL validation

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...

CVE-2026-81920

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...

CVE-2026-81923

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord action validated the per-page CSRF token but never called canEditPageProperties for the target page, so a user who was granted access to the bulk SEO tool and...

EUVD-2026-79294

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord action validated the per-page CSRF token but never called canEditPageProperties for the target page, so a user who was granted access to the bulk SEO tool and...

CVE-2026-81920

Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the dashboard SEO Excluded Words page. The reset() controller action cleared the administrator-configured reserved-word list (concrete.seo.exclude_words) without validating the anti-CSRF token or restricting the reques...

CVE-2026-81920 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...

CVE-2026-81920 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...

EUVD-2026-79285

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...