CVE-2026-112254 agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery

A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function fetchhtml of the file locations/services/propertyurlimporter.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The...

CVE-2026-112254 agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery

A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function fetchhtml of the file locations/services/propertyurlimporter.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The...

CVE-2026-111750

A flaw was found in aiohttp. When running with the pure Python parser instead of compiled extensions, the parser accepts ambiguous HTTP Hypertext Transfer Protocol request framing. An unauthenticated remote attacker could exploit this flaw by sending specially crafted requests through an...

CVE-2026-112251

A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/main/services/reverseProxy.ts of the component Reverse Proxy. Performing a manipulation of the argument token results in open redirect. The attack can be...

CVE-2026-106587

A flaw was found in OpenSSH. When certain configuration options are set to "none" within a conditional block to disable a feature, the OpenSSH server daemon sshd incorrectly interprets the value as a literal file path rather than disabling the setting. A local attacker could exploit this issue by...

CVE-2026-70165

A flaw was found in .NET. An authorized local attacker could exploit this vulnerability to achieve privilege escalation on the host system. The issue is caused by improper link resolution before file access, where the application fails to properly validate file links. By manipulating these links,...

CVE-2026-66055

A flaw was found in Apache Thrift. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending specially crafted requests. Because the affected bindings fail to properly restrict resource allocation during request handling, an attacker can exhaust system resources and...

CVE-2026-96225

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-96231

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-96236

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

CVE-2026-55480

A flaw was found in CUPS. Insecure temporary file handling allows a local attacker with print administrative privileges to overwrite arbitrary system files. When configuring a printer, the print service creates a temporary file with a predictable name in a shared directory without verifying wheth...

CVE-2026-88901

A flaw was found in the Apache Camel Smooks component camel-smooks. This vulnerability allows an unauthenticated remote attacker to cause information disclosure by submitting a crafted XML message containing external entity references. Because the component processes incoming XML data without...

EUVD-2026-104571

A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/main/services/reverseProxy.ts of the component Reverse Proxy. Performing a manipulation of the argument token results in open redirect. The attack can be...

CVE-2026-112377

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuin...

CVE-2026-112248

A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated...

CVE-2026-112249 grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting

A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched...

CVE-2026-112249 grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting

A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched...

CVE-2026-91779

A flaw was found in GNU Binutils. A local attacker can trigger a null pointer dereference within the Eh Frame Handler component by performing a specific manipulation. This vulnerability can lead to a Denial of Service DoS, making the affected system or application unavailable...

CVE-2026-98530

A flaw was found in the Linux kernel's kprobes subsystem. A privileged local user could trigger improper synchronization when disabling or flushing probe optimization, causing the process to hang indefinitely while holding an internal lock. This issue can make administrative interfaces...

CVE-2026-91780

A flaw was found in GNU Binutils. A local attacker can trigger a null pointer dereference by manipulating input to the 'elflinkaddobjectsymbols' function. This can lead to a denial of service DoS condition, making the affected component unavailable...