AZL-95907 CVE-2026-73500 affecting package cloud-provider-kubevirt for versions less than 0.5.1-7

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handle...

CVE-2026-73307

Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows.ts. A builder with the AI...

Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests

A flaw was found in Next.js. Self-hosted applications utilizing the built-in Node.js server are vulnerable to Server-Side Request Forgery SSRF through specially crafted WebSocket upgrade requests. A remote attacker can exploit this by causing the server to proxy requests to arbitrary internal or...

Qualys Introduces Real-Time Cloud Security Posture Management (CSPM) for Faster Risk Detection and Remediation

Key Takeaways Cloud environments change continuously, while security still relies on periodic scans, leaving gaps where risks go undetected. That gap becomes exposure. Qualys Real-Time CSPM monitors cloud changes as they happen, while still supporting periodic scans for environments that require...

CVE-2026-73307

Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows.ts. A builder with the AI...

CVE-2026-73297

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, isblockedip in ufo/utils/urlsecurity.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check embedde...

EUVD-2026-57325

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, isblockedip in ufo/utils/urlsecurity.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check embedde...

CVE-2026-49262

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route cmsproxy is vulnerable to a Server-Side Request Forgery SSRF attack via DNS Rebinding. A Time-of-Check to Time-of-Use TOCTOU race condition exists between the URL validation phase and the actua...

CVE-2026-73432

CVE-2026-73432 affects Vulnerability-Lookup: SSRF via remote-instance synchronization where addresses were only validated for syntax before storage and later dereferenced with requests.get(), following redirects without network-boundary checks. An authenticated admin (admin:access) can configure ...

CVE-2026-73432 Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

CVE-2026-73432 Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

EUVD-2026-57231

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

CVE-2026-73264

Prowler (cloud security platform) contains an SSRF risk prior to version 5.33.1. An authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider via POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/...

CVE-2026-73262

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resourcetags, assembled by unrolldict and parsehtmlstring, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned...

CVE-2026-73262 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resourcetags, assembled by unrolldict and parsehtmlstring, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned...

CVE-2026-73262 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resourcetags, assembled by unrolldict and parsehtmlstring, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned...

CVE-2026-49262

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route cmsproxy is vulnerable to a Server-Side Request Forgery SSRF attack via DNS Rebinding. A Time-of-Check to Time-of-Use TOCTOU race condition exists between the URL validation phase and the actua...

CVE-2026-49262 Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route cmsproxy is vulnerable to a Server-Side Request Forgery SSRF attack via DNS Rebinding. A Time-of-Check to Time-of-Use TOCTOU race condition exists between the URL validation phase and the actua...

CVE-2026-49262

CVE-2026-49262 : Aimeos Pagible CMS before version 0.10.4 exposes the administrative proxy route cmsproxy to a Server-Side Request Forgery (SSRF) via DNS rebinding. A TOCTOU race between URL validation and the actual HTTP request allows an attacker to access internal network resources and cloud m...

CVE-2026-49262 Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route cmsproxy is vulnerable to a Server-Side Request Forgery SSRF attack via DNS Rebinding. A Time-of-Check to Time-of-Use TOCTOU race condition exists between the URL validation phase and the actua...