CVE-2026-93694 Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content...

meg

meg meg es una herramienta para obtener muchas URLs pero siendo 'amable' con los servidores. Se puede usar para obtener muchas rutas de muchos hosts; obteniendo una ruta para todos los hosts antes de pasar a la siguiente ruta y repetir. Obtienes muchos resultados rápidamente, pero ninguno de los...

xcrawl3r

xcrawl3r xcrawl3r es una utilidad de línea de comandos diseñada para rastrear recursivamente páginas web en busca de URLs. Funciona recorriendo activamente los sitios web, siguiendo enlaces incrustados en páginas web y analizando archivos incluyendo sitemaps y robots.txt para descubrir cada URL. ...

uro

uro Usar una lista de URLs para pruebas de seguridad puede ser tedioso, ya que hay muchas URLs con contenido poco interesante/duplicado; uro tiene como objetivo solucionar eso. No realiza ninguna solicitud http a las URLs y elimina: URLs incrementales, p. ej. /page/1/ y /page/2/ publicaciones de...

EUVD-2026-97127

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request...

CVE-2026-109559: Incorrect Authorization

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

PT-2026-110421

Name of the Vulnerable Software and Affected Versions houtini-ai voice-analyser-mcp versions prior to 2.1.2 Description A server-side request forgery SSRF exists within the collect corpus component. This occurs when the fetch function in the src/utils/crawler.ts file improperly handles the sitema...

PT-2026-110579

Name of the Vulnerable Software and Affected Versions Progress ShareFile Storage Zones Controller versions prior to 5.12.7 Description Processing of queue items can send acknowledgements to an unvalidated callback URL. This behavior, combined with a race condition, allows an attacker to force the...

PT-2026-111094

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description A remote attacker can perform directory traversal on the system. By sending a specially crafted URL request containing "dot dot" sequences /../, an attacker can write arbitrary files ...

PT-2026-110900

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

PT-2026-110927

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description Authenticated attackers can perform a server-side request forgery SSRF by providing a remote URL, such as a remote document or a syndicated site feed. The issue exists in the recuperer url function...

PT-2026-110708

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.33 through 0.11.3 Description Authenticated users can execute scripts in other users' sessions by storing javascript: URLs within the citation embed url fields. An attacker can share a specially crafted chat; when a...

PT-2026-110744

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript:...

PT-2026-110935

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-109327: Improper Neutralization of Input During Web Page Generation

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript:...

CVE-2026-108916: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and...

CVE-2026-109422: Exposed Dangerous Method or Function

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

CVE-2026-92116: URL Redirection to Untrusted Site

OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...

CVE-2026-75061: Improper Limitation of a Pathname to a Restricted Directory

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to write arbitrary files on the system...

PT-2026-110963

Name of the Vulnerable Software and Affected Versions IBM Maximo Application Suite versions 8.10 through 9.2 Description A remote attacker can perform directory traversal on the system. By sending a specially crafted URL request containing "dot dot" sequences /../, an attacker can view arbitrary...