CVE-2026-53668

A flaw was found in React Router. Applications using React Router that allow open redirects are vulnerable to Cross-Site Scripting XSS. A remote attacker could craft a malicious link that, when clicked by a user, redirects them to an unexpected external site or exploits an XSS vulnerability,...

XStream 1.4.18 - Remote Code Execution

XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

SUSE CVE-2026-44621

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...

GO-2026-6030 Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter in code.gitea.io/gitea

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter in code.gitea.io/gitea...

tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local...

CVE-2026-44621

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...

CVE-2026-44621

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...

EUVD-2026-47667

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...

CVE-2026-44621

The CVE describes a vulnerability in NLnet Labs Unbound up to version 1.25.1 where applications using libunbound and configuring the unwanted-reply-threshold (non-zero) can trigger a fatal exit of libunbound when threshold is exceeded and libworker_alloc_cleanup is not on the function-call allow ...

PT-2026-63471

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This failure in...

PT-2026-63375

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.25.2 Description Applications using libunbound configured with the unwanted-reply-threshold parameter may be abruptly terminated. This occurs when the threshold is reached and libunbound attempts to call...

GHSA-H2X6-G7Q6-344V Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

Summary Gitea's repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validation logic accepts the destination if any resolved IP is allowed, even if another resolved IP is loopback, private, or otherwise blocked. The later git clone...

GHSA-2R5C-GW76-RH3W Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Summary Gitea's default SSRF allow-list MatchBuiltinExternal, used by both webhook delivery and repository migrations relies on Go's standard library net.IP.IsPrivate, which only covers RFC 1918 and RFC 4193. As a result, several IP ranges commonly used for cloud metadata services, internal...

EUVD-2026-41618

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter...

CVE-2026-46555

The CVE applies to WhatsApp MCP Server, where the whatsapp-bridge HTTP API on 127.0.0.1:8080 is unauthenticated and lacks Host header validation. The /api/send endpoint accepts an absolute media_path, enabling a local caller (including sibling MCP servers, IDE extensions, or other processes in th...

CVE-2026-58481 Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, AgentRuntime promises scoped file access under a configured sandbox basePath, but its path containment checks use raw string prefix tests. A sandbox base such as /tmp/network-ai-sandbox also matches a sibling pa...

CVE-2026-63736

SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists without checking resolved IP addresses. An Owner role attacker can point an access method at an allow-listed hostname resolving to privat...

CVE-2026-63736 SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution

SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists without checking resolved IP addresses. An Owner role attacker can point an access method at an allow-listed hostname resolving to privat...

CVE-2026-63736 SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution

SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists without checking resolved IP addresses. An Owner role attacker can point an access method at an allow-listed hostname resolving to privat...

PT-2026-61552

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.2.0 Description A server-side request forgery SSRF issue exists in the JWKS fetcher. The system validates the URL hostname string against allow-lists but fails to verify the resolved IP addresses. An attacker with...