CVE-2026-64968

ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...

CVE-2026-64968 Server-Side Request Forgery in ATutor

ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...

CVE-2026-76341

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:49+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76335

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:34+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-22 19:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtozkg3nfx24...

CVE-2026-76328

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:19+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76316

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:50+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 23:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmwink3bv24...

CVE-2026-76315

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:48+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 23:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmuszamoh23...

GO-2026-6112 vulnerabilities

Vulnerabilities for packages: dataplaneapi, crossplane-provider-aws-elasticache, crossplane-provider-aws-cloudfront, crossplane-provider-family-aws, crossplane-provider-keycloak, crossplane-provider-aws-memorydb, crossplane-provider-family-azure, gitness, crossplane-provider-aws-eks,...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: kyverno, kapp-controller, gatekeeper, cluster-api-azure-controller, vcluster, k8ssandra-client, kyverno-notation-aws, kube-vip-cloud-provider, kubernetes-csi-external-provisioner, cilium, kubescape-operator, flux-notification-controller, kwok, openbao,...

CVE-2026-73500 affecting package cloud-provider-kubevirt for versions less than 0.5.1-7

CVE-2026-73500 affecting package cloud-provider-kubevirt for versions less than 0.5.1-7. A patched version of the package is available...

CVE-2026-73500 affecting package kube-vip-cloud-provider for versions less than 0.0.10-8

CVE-2026-73500 affecting package kube-vip-cloud-provider for versions less than 0.0.10-8. A patched version of the package is available...

EUVD-2026-63103

In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the Splunk Observability Cloud access token stored fo...

PT-2026-79262

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored...

CVE-2026-47827 - BOSH CLI Powershell Injection | Cloud Foundry

HIGH CVSSv4: High 7.7 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSSv3: High 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Vendor CloudFoundry Foundation Versions Affected Severity is HIGH unless otherwise noted. BOSH CLI tool – All versions v2.840.0 Description Command...

CVE-2026-76251

In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the Splunk Observability Cloud access token stored fo...

EUVD-2026-62855

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The...

CVE-2026-53549 Termix: Server-Side Request Forgery via Proxy Connectivity Test

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The...

SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

Ref: https://github.com/ihor-sokoliuk/mcp-searxng/issues/87issuecomment-4645453694 Summary The weburlread tool fetches a caller-supplied URL server-side and converts it to markdown. An SSRF guard assertUrlAllowed, which blocks private/loopback/metadata addresses exists but runs only when...

GHSA-Q87F-QC2R-2GW4 SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

Ref: https://github.com/ihor-sokoliuk/mcp-searxng/issues/87issuecomment-4645453694 Summary The weburlread tool fetches a caller-supplied URL server-side and converts it to markdown. An SSRF guard assertUrlAllowed, which blocks private/loopback/metadata addresses exists but runs only when...

Security Bulletin: Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

Summary The github.com/hashicorp/go-slug library before v0.18.3 is vulnerable to an exclusion bypass in .terraformignore handling that may allow files intended to be excluded from Terraform Cloud or Terraform Enterprise working directory uploads to be included instead on affected macOS filesystem...