CVE-2026-94040: Server-Side Request Forgery (SSRF)

A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/app/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may b...

claude-security-audit

Claude Security Audit A complete security auditor for Clau...

CLEANSTART-2026-LY97922 Security fix for ghsa-45p5-v273-3qqr applied in: incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, keycloak 26.1.4-r1, keycloak 26.2.12-r0, keycloak 26.5.0-r0, keycloak 26.5.0-r2, keycloak 26.5.7-r0, kogito-apps 10.1.0-r0

ghsa-45p5-v273-3qqr affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HQ10523 Security fix for ghsa-h5fg-jpgr-rv9c applied in: incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, keycloak 26.1.4-r1, keycloak 26.2.12-r0, keycloak 26.5.0-r0, keycloak 26.5.0-r2, keycloak 26.5.7-r0, kogito-apps 10.1.0-r0

ghsa-h5fg-jpgr-rv9c affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VG40041 Security fix for ghsa-5rfx-cp42-p624 applied in: keycloak 26.4.7-r3, keycloak 26.5.0-r0, keycloak 26.5.0-r2, kogito-apps 10.1.0-r0

ghsa-5rfx-cp42-p624 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZX15129 Security fix for ghsa-cphf-4846-3xx9 applied in: incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, keycloak 26.4.10-r0, keycloak 26.4.11-r2, keycloak 26.4.7-r3, keycloak 26.5.6-r5, kogito-apps 10.1.0-r0, spark-sc213-jdk17-py311 4.1.1-r2, strimzi-kafka-operator 0.50.0-r0

ghsa-cphf-4846-3xx9 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AL62330 Security fix for CVE-2025-11966 applied in: apicurio-registry 3.1.7-r6, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, keycloak 26.4.7-r5, keycloak 26.5.7-r4, kogito-apps 10.1.0-r0

CVE-2025-11966 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DH52252 Security fix for ghsa-vgq5-3255-v292 applied in: kogito-apps 10.1.0-r0

Security vulnerability affects the kogito-apps package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-BG00340 Security fix for CVE-2025-27817 applied in: kogito-apps 10.1.0-r0

Security vulnerability affects the kogito-apps package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-XL50889 Security fix for CVE-2025-49146 applied in: kogito-apps 10.1.0-r0

Security vulnerability affects the kogito-apps package. This issue is resolved in later releases. See references for vulnerability details...

EUVD-2026-82592

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-82589

Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

PT-2026-102082

Security vulnerability affects the kogito-apps package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-77164: Server-Side Request Forgery (SSRF)

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

PT-2026-95208

Name of the Vulnerable Software and Affected Versions Nextcloud affected versions not specified Description Remote-instance signature verification in Circles fetches the keyId URL provided by an attacker before trust is established. This process explicitly allows local or private addresses,...

PT-2026-100348

Security vulnerability affects the kogito-apps package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100155

Security vulnerability affects the kogito-apps package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-83944

Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-70200

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-70200

Azure Logic Apps is affected by a path traversal vulnerability (improper limitation of a pathname to a restricted directory) that allows an unauthorized attacker to elevate privileges over a network. The CNA-assigned CVSS 3.1 score is 10.0 (Critical) , reflecting a network-based attack with low c...