PT-2026-94072

Name of the Vulnerable Software and Affected Versions Coze Studio versions prior to 0.5.2 Description Authenticated users can exploit a lack of restriction on the server URL provided during the registration of plugin tools. This allows the backend to fetch internal services, enabling attackers to...

CVE-2025-56563

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

CVE-2026-92804: Server-Side Request Forgery (SSRF)

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potential...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38415)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability in access control. This vulnerability stems from an improper access control in the getCloudDownloadStatus function. Attackers can exploit this vulnerability by sending a specially crafted POS...

CVE-2026-92568: Server-Side Request Forgery (SSRF)

MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows authenticated users to make the API server send arbitrary HTTP requests to internal addresses. Attackers can update a run with a malicious webhook notification that executes wh...

SUSE SLES12 Security Update : google-cloud-sap-agent (SUSE-SU-2026:4178-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4178-1 advisory. Security issues fixed: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272128....

openSUSE 16 Security Update : google-cloud-sap-agent (openSUSE-SU-2026:21834-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21834-1 advisory. Security issues fixed: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272128. -...

CVE-2026-54544

Fireshare , a self-hosted media and link sharing platform, contains an unauthenticated SSRF vulnerability prior to version 1.6.16 . Two API endpoints—POST /api/test-discord-webhook and POST /api/test-webhook—are missing the @login_required decorator, allowing an attacker to trigger arbitrary outb...

CVE-2026-54544 Fireshare has unauthenticated SSRF via missing login_required on webhook test endpoints

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @loginrequired decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by uncontrolled resource consumption vulnerabilities due to Apache Neethi (CVE-2026-66142, CVE-2026-66143, CVE-2026-66144)

Summary There is a vulnerability in the Apache Neethi library that affects IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, with the jaxrs-1.1, jaxrs-2.0, jaxrs-2.1, restfulWS-3.0, restfulWS-3.1 , restfulWS-4.0, json-1.0, jsonp-1.0, jsonp-1.1,...

CVE-2026-83417

Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications component: SEPP. Supported versions that are affected are 26.1.200 and 25.2.201. Easily exploitable vulnerability allows unauthenticated attacker with access to the physica...

CVE-2026-83085

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the...

CVE-2026-83087

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud...

CVE-2026-83086

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud...

CVE-2026-83075

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud...

CVE-2026-83077

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud...

CVE-2026-83078

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud...

CVE-2026-83074

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via SSH to compromise Siebel CRM Cloud...

CVE-2026-83079

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Cloud Application...

CVE-2026-83073

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the...