13532 matches found
CVE-2026-58178
The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...
CVE-2026-6089
The WP CTA plugin for WordPress (all versions up to 2.1.2) is vulnerable to Server-Side Request Forgery via the sticky_s_media parameter in imported JSON. The import_sidebars() function passes user-supplied URLs to file_get_contents() after only FILTER_VALIDATE_URL validation, allowing internal I...
CVE-2026-58178 Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery
The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...
Linux Distros Unpatched Vulnerability : CVE-2026-66754
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to...
Linux Distros Unpatched Vulnerability : CVE-2026-58156
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0...
PT-2026-65874
Name of the Vulnerable Software and Affected Versions openSUSE Tumbleweed python311-pip versions prior to 26.2-1.1 Description pip incorrectly handles doubly-encoded package URLs from indexes. This allows files to be installed to arbitrary locations on disk, even when installing wheels pre-compil...
CVE-2026-54690
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or...
CVE-2026-54690
Summary: CVE-2026-54690 affects the datamodel-code-generator project. In versions 0.9.1 through 0.61.0, the tool silently dereferenced attacker-controlled JSON Schema $ref HTTP/HTTPS URLs via src/datamodel_code_generator/parser/jsonschema.py:_get_ref_body, and the --allow-remote-refs gate could w...
Server-side Request Forgery (SSRF)
Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the getbody function when processing URLs provided via the --url argument, as there is no validation of host or IP addresses and redirects are...
EUVD-2026-38633
Poweradmin has Host Header Injection in OIDC redirecturi, SAML ACS/SLO URL, and Logout Redirect Construction...
CVE-2026-67173
Pivotick exposes a URI handling flaw in graph rendering: node imagePath values derived from graph data are not validated for their URL schemes before being assigned to SVG image resources. An attacker could supply crafted graph data to cause an image path to point to a malicious URI, and when a v...
OPENSUSE-SU-2026:21464-1 Security update for libkrun
This update for libkrun fixes the following issues: - CVE-2025-24898: openssl: use-after-free in ssl::selectnextproto due to improper lifetime handling bsc1270429. - CVE-2026-41676: openssl: short buffer overflow via Deriver:derive and PkeyCtxRef:derive when using OpenSSL 1.1.1 bsc1270198. -...
CVE-2026-51564
An issue in the redirect parameter in Milk admin =0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request...
CVE-2026-65925 Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository
A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...
CVE-2026-65925
CVE-2026-65925 describes a Server-Side Request Forgery (SSRF) in JFrog Artifactory when using the Cargo remote repository. A user with read access to the Cargo remote repository could cause Artifactory to request unintended URLs and return the response. The CVSS 3.1 vector is NETWORK, PRIVILEGES ...
CVE-2026-66390 Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...
CVE-2024-14040
creationtimestamp| type| source ---|---|--- 2026-07-27 10:02:40+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrmndc3mf32m 2026-07-27 10:03:38+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrmnf26upm2u 2026-07-27 10:03:40+00:00| seen|...
CVE-2026-65698
A flaw was found in Void through 1.3.4 in the AI agent file-reading tools readfile, lsdir, getdirtree, and search. Those tools do not confine paths to the open workspace and can accept absolute paths or file:// URIs, including bypassing the approval gate. An attacker who can inject instructions...
