CVE-2026-82660

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

UBUNTU-CVE-2026-82660

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

CVE-2026-82866 @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to...

CVE-2026-82866

@pdfme/common before 5.5.10 contains a server-side request forgery (SSRF) vulnerability in the getB64BasePdf function. When the basePdf template field is attacker-controlled, the function fetches arbitrary URLs without validation, allowing attackers to force servers or clients to request internal...

CVE-2026-82866 @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to...

CVE-2026-82660 Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

CVE-2026-82660

Nodemailer before version 8.0.9 is affected by an access-control bypass in jsonTransport during message normalization. The disableFileAccess and disableUrlAccess options are not enforced, allowing an attacker to read local files or fetch arbitrary URLs by supplying crafted path or href values in ...

EUVD-2026-68438

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

CVE-2026-82660 Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

CVE-2026-82660 Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

PT-2026-83975

A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the component fetch-tools Endpoint. The manipulation results in server-side request forgery. The attack may be launched remotely. The...

PT-2026-83725

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

CVE-2026-82905: Server-Side Request Forgery (SSRF)

A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the component fetch-tools Endpoint. The manipulation results in server-side request forgery. The attack may be launched remotely. The...

CVE-2026-82660: Missing Authorization

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

CVE-2026-62993: Server-Side Request Forgery (SSRF)

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's fetch handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri to...

PT-2026-84035

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 4.5.7 Smarty versions prior to 5.8.2 Description Smarty is a PHP template engine that separates presentation from application logic. A flaw exists in the fetch handling within libs/plugins/function.fetch.php and...

CVE-2026-71378: Cross-Site Request Forgery (CSRF)

ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was derived from a reference implementation...

CVE-2026-82662: Improper Certificate Validation

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

Linux Distros Unpatched Vulnerability : CVE-2026-82660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local...

PT-2026-89178

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.5 through 0.11.0 Description An authenticated user can perform a Server-Side Request Forgery SSRF attack when the AIOHTTP CLIENT ALLOW REDIRECTS variable is set to true. The platform fails to reapply the WEB FETCH FILTE...