CVE-2026-55787

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validateurlssrf and isprivateip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition...

CVE-2026-55787 Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validateurlssrf and isprivateip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition...

CVE-2026-55787 Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validateurlssrf and isprivateip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition...

CVE-2026-100169 Account pre-hijacking in the Prowler API through email based social account linking without verification

Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.presociallogin in...

Checkov by Prisma Cloud: Path Traversal Vulnerabilities

Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem. Work around: Until a fixed version is deployed, avoid running Checkov over untrusted content, and pass configuration...

Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability

A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services. Work around: Until a fixed version is deployed, avoid running Checkov over untrusted content, and...

CVE-2026-110621

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking I...

CVE-2026-110690

Cloud Commander cloudcmd versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root function instead of the root.resolve validation wrapper used elsewhere. Attackers can sen...

CVE-2026-110628

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services, localho...

EUVD-2026-101256

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services, localho...

CVE-2026-110628

Versions 0.5.5 through 0.6.0 of Kan are vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . This vulnerability exists in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255 . If the S3_ENDPOINT environment variable is unset, an attacker can provide ar...

CVE-2026-110628 Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services, localho...

CVE-2026-110621 Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking I...

EUVD-2026-101249

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking I...

CVE-2026-110621

Swetrix Cloud versions prior to 5.1.0 are affected by a missing authorization vulnerability in the ProjectController.addProject function. This flaw allows authenticated users to hijack arbitrary projects by moving them into their own organization using a public tracking ID. Successful exploitatio...

CVE-2026-110621 Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking I...

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-70906 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successfu...

CVE-2026-110690

Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 are vulnerable to a path traversal vulnerability in the GET /api/v1/pack endpoint. The issue arises because the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrappe...

CVE-2026-110690 Cloud Commander 19.20.2 through 19.21.1 Path Traversal via GET /api/v1/pack

Cloud Commander cloudcmd versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root function instead of the root.resolve validation wrapper used elsewhere. Attackers can sen...

CVE-2026-110690 Cloud Commander 19.20.2 through 19.21.1 Path Traversal via GET /api/v1/pack

Cloud Commander cloudcmd versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root function instead of the root.resolve validation wrapper used elsewhere. Attackers can sen...