CVE-2026-54724: URL Redirection to Untrusted Site

Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted...

PT-2026-92109

Summary Server-Side Request Forgery SSRF vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block. Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is...

CVE-2026-91088: Heap-based Buffer Overflow

A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gfurlconcatenateex of the file utils/url.c of the component URL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. Upgrading to version abi-16.23 is capable o...

CVE-2026-54689: Exposure of Sensitive Information to an Unauthorized Actor

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the weburlread URL policy in src/url-reader.ts can be bypassed while MCPHTTPHARDEN is enabled and MCPHTTPALLOWPRIVATEURLS is not enabled because redirec...

MiracleLinux 8 : git-lfs-3.4.1-13.el8_10 (AXSA:2026-1833:12)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1833:12 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Deni...

MiracleLinux 9 : git-lfs-3.7.1-4.el9_8.3 (AXSA:2026-1842:13)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1842:13 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Deni...

CVE-2026-91146

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2026-91199

Refly (versions through 1.1.0) is affected by a server-side request forgery (SSRF) vulnerability in the POST /v1/misc/scrape endpoint. The endpoint fetches caller-supplied URLs without validating the scheme, host, or resolved address, allowing authenticated attackers to make the backend issue req...

CVE-2026-91199 Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2026-91146

Takahe versions through 0.11.0 fail to restrict URL schemes in link hrefs within federated post content and profile summaries. This allows remote attackers to inject javascript: links that execute in the instance origin when a user clicks them, enabling session hijacking or impersonation of viewe...

CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

Security Bulletin: IBM Virtualization Engine TS7700 is susceptible to multiple vulnerabilities in Python.

Summary IBM Virtualization Engine TS7700 is susceptible to two Tampering conditions and one potential Elevation of Privilege issue due to the use of Python CVE-2025-0938, CVE-2025-47273, CVE-2025-1795. TS7700 uses Python to perform operations with the Cloud and internal system configuration tasks...

CVE-2026-13277

IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web si...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-12765

IBM Langflow OSS versions 1.0.0 through 1.10.2 are vulnerable to server-side request forgery (SSRF) in several flow components, including LM Studio, Home Assistant, DeepSeek, xAI, Glean, HuggingFace Inference API, Ollama, LiteLLM, and Docling Serve. These components accept user-supplied URL value...

CVE-2026-12765 Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2026-12765 Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2026-12766

IBM Langflow OSS (versions 1.0.0–1.11.2) is vulnerable to Server-Side Request Forgery (SSRF) across multiple components. The root cause involves missing or bypassable URL validation: the LMStudio and embeddings components pass a user-controlled base_url to httpx.AsyncClient without invoking the S...