PT-2026-99710

Name of the Vulnerable Software and Affected Versions Obot versions prior to 0.23.0 Description Obot contains a server-side request forgery SSRF issue during remote MCP server registration. Privileged users with Power User, Power User Plus, or Admin roles can specify arbitrary URLs in the...

PT-2026-95435

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Data version 5.1.2 Description A remote attacker can perform directory traversal on the system by sending a specially crafted URL request containing "dot dot" sequences /../. This allows the attacker to view arbitrary files o...

PT-2026-100697

Security vulnerability affects the cloud-config-server package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-95696

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download file to uploads function. This is due to the import action being registered for...

CVE-2026-93031: Unrestricted Upload of File with Dangerous Type

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the downloadfiletouploads function. This is due to the import action being registered for...

Oracle Enterprise Manager Cloud Control (September 2026 CSPU)

The 13.5.0.0 and 24.1.0.0 versions of Enterprise Manager Cloud Control installed on the remote host are affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager...

CVE-2026-54507

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

EUVD-2026-82567

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

CVE-2026-54507 Vvveb oEmbedProxy vulnerable to server-side request forgery

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Summary When Steeltoe's certificate-based authorization UseCertificateAuthorization is configured, the default configuration of the middleware relies on the X-Client-Cert HTTP header to identify the client certificate, without verifying private-key possession. This header is not stripped by commo...

GHSA-5MQ7-RWHJ-4FH9 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Summary When Steeltoe's certificate-based authorization UseCertificateAuthorization is configured, the default configuration of the middleware relies on the X-Client-Cert HTTP header to identify the client certificate, without verifying private-key possession. This header is not stripped by commo...

CVE-2026-89038

Verizon Cloud for Android com.vcast.mediamanager before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to write attacker-controlled bytes outside the intended staging directory by supplying a crafted displayname value containing path-traversal...

CVE-2026-54546

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL in api/routes/basemap.ts to fetchurl without resolved-address...

CVE-2026-89038

Verizon Cloud for Android (com.vcast.mediamanager) versions before 26.7.10 contain a path traversal vulnerability in the exported activities OneTouchUploadActivity and PrintShopCloudActivity . The root cause is unsanitized filename concatenation in the file-staging sink: a co-resident malicious a...

CVE-2026-89038 Verizon Cloud for Android < 26.7.10 Path Traversal via OneTouchUploadActivity

Verizon Cloud for Android com.vcast.mediamanager before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to write attacker-controlled bytes outside the intended staging directory by supplying a crafted displayname value containing path-traversal...

EUVD-2026-82341

Verizon Cloud for Android com.vcast.mediamanager before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to write attacker-controlled bytes outside the intended staging directory by supplying a crafted displayname value containing path-traversal...

CVE-2026-89038 Verizon Cloud for Android < 26.7.10 Path Traversal via OneTouchUploadActivity

Verizon Cloud for Android com.vcast.mediamanager before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to write attacker-controlled bytes outside the intended staging directory by supplying a crafted displayname value containing path-traversal...

EUVD-2026-57013

Kestra: SSRF via Pebble http function allows unauthenticated access to internal services & cloud metadata...

GHSA-R56G-Q4P6-M3P6 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...

Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...