CVE-2026-116578

The Tornado Python web framework and asynchronous networking library (versions prior to 6.6 ) is vulnerable to an open redirect in tornado.web.RedirectHandler. The root cause is that URL templates allow regex-capture substitutions in positions where crafted request paths can modify the redirect s...

Hitachi Pentaho Business Analytics Server - Bypass Authorization

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented. id: CVE-2022-43939 info: name: Hitachi Pentaho Business Analytics Server - Bypass Authorization author: daffainf...

PT-2026-125524

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens,...

CVE-2026-116205

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying |URL wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal...

CVE-2026-116169

The SiYuan note-taking application (versions 2.10.0 before 3.8.7 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The issue occurs when KaTeX trust is enabled, allowing users with edit permissions to inject javascript: URLs into math block content. Specifically, the mathRender functio...

CVE-2026-116169 SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks

SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math block content rendered with KaTeX trust enabled. Attackers can store \href, \url, or \includegraphics payloads that...

PT-2026-123010

SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math block content rendered with KaTeX trust enabled. Attackers can store href, url, or includegraphics payloads that...

LLM WikiLeaks: Uncovering URL-Based Capability Extension and Security Circumvention in Agentic Message Boards

Autonomous agents have been observed acting beyond their assigned tasks, accessing unauthorized systems, and establishing communication channels to exchange information, yet the Web and network-level techniques they use to extend their capabilities and circumvent security restrictions remain poor...

PT-2026-123023

phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can influence FAQ content can embed image URLs pointing to loopback or internal services, causing the server to request them...

SUSE CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

EUVD-2026-107011

SvelteKit: URL redirection to untrusted site via enhanced form submission...

CVE-2026-115730

A flaw was found in i18next-http-backend. A remote attacker who can control namespace values can supply input starting with a slash to construct protocol-relative URLs in path templates. This flaw allows translation requests to be redirected to an attacker-controlled server, leading to cross-site...

CLEANSTART-2026-UV08915 Actions which insert URLs into the content attribute of HTML meta tags are not escaped

Security vulnerability affects the argo-cd package. Actions which insert URLs into the content attribute of HTML meta tags are not escaped...

CLEANSTART-2026-RP71173 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the argo-cd package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

DEBIAN-CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

EUVD-2026-107361

Electron: openExternal permission requests can be attributed to the wrong origin...

Server-Side Request Forgery (SSRF)

A2A Java SDK is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of push notification destination URLs and unrestricted redirect handling, which allows an unauthenticated attacker to make the server send HTTP requests to internal or restricted...

SUSE CVE-2026-114121

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the...

SSRF and local file disclosure via unvalidated URLs

Applications that pass attacker-controlled URLs to webpage versions before 2.1.0 may be vulnerable to server-side request forgery SSRF or local file disclosure. HTTP::fetch and Webpage::fromurl passed URLs to libcurl without restricting the URL scheme or validating the resolved destination IP...