CVE-2026-102095 Kiteworks Email Protection Gateway server-side request forgery

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote,...

CVE-2026-102095 Kiteworks Email Protection Gateway server-side request forgery

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote,...

CLEANSTART-2024-OZ46983 When instructing cloud-init to set a random password for a new user account, versions before 21

Security vulnerability affects the cloud-init package. When instructing cloud-init to set a random password for a new user account, versions before 21...

CLEANSTART-2024-WH54891 Sensitive data could be exposed in world readable logs of cloud-init before version 22

Security vulnerability affects the cloud-init package. Sensitive data could be exposed in world readable logs of cloud-init before version 22...

CLEANSTART-2024-JF46935 Sensitive data could be exposed in logs of cloud-init before version 23

Security vulnerability affects the cloud-init package. Sensitive data could be exposed in logs of cloud-init before version 23...

CVE-2026-55177

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

Security Bulletin: Vulnerabilities in netty-codec-http,spring-core,brace-expandsion,netty-transport,log4j-core,spring-expression,js-cookie,spring-security,spring-cloud,spring-boot,spring-hateoas might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in netty-codec-http,spring-core,brace-expandsion,netty-transport,log4j-core,spring-expression,js-cookie,spring-security,spring-cloud,spring-boot,spring-hateoas. Vulnerabilities include resource exhaustion and...

Security Bulletin: Vulnerabilities in Netty,Spring Boot,ZDRES-232,Apache HttpComponents,Spring Security,PostCSS,spring-cloud-gateway-server might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, Spring Boot, ZDRES-232, Apache HttpComponents,Spring Security, PostCSS,spring-cloud-gateway-server. Vulnerabilities include attacker supplies com.myapp.SomeClass causes clinit of SomeClass â€" and many...

CVE-2026-55177

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

EUVD-2026-90083

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-55177

CloudTAK is vulnerable to a full-read Server-Side Request Forgery (SSRF) in the ESRI helper family routes (e.g., POST /api/esri) prior to version 13.10.0 . The root cause is a lack of IP/DNS/hostname classification; the api/lib/esri.ts library uses a bare fetch on attacker-controlled URLs without...

CVE-2026-55177 CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guard

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

ROOT-APP-MAVEN-CVE-2026-59284 CVE-2026-59284 in org.springframework.cloud:spring-cloud-commons - Patched by Root

Root has patched CVE-2026-59284 in the org.springframework.cloud:spring-cloud-commons package for Root:Maven. Multiple fixed versions available...

MAL-2026-17436 Malicious code in okra-cloud-cdk (npm)

okra-cloud-cdk is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, working...

Malicious code in okra-cloud-cdk (npm)

okra-cloud-cdk is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, working...

prowler v5.44.0

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

CVE-2026-102095: Server-Side Request Forgery (SSRF)

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote,...

CVE-2024-58387: Improper Limitation of a Pathname to a Restricted Directory

Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/modelreport/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as...

Linux Distros Unpatched Vulnerability : CVE-2026-93853

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots...

PT-2026-103533

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0 Description An issue exists where the system performs server-side fetches of URLs found within processed message content without sufficient destination restrictions. This allows a...