CVE-2026-47879

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier...

EUVD-2026-66842

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier...

CVE-2026-47879

Spring Cloud Gateway's JsonToGrpcGatewayFilterFactory permits arbitrary Spring Resource locations when defining the proto descriptor, enabling SSRF and native file access via gRPC. Affected versions span 5.0.0–5.0.2 , 4.3.0–4.3.5 , 4.0.0–4.2.9 , and 3.1.13 and earlier . The CVSS 3.1 score is 7.7 ...

CVE-2026-47879 Spring Cloud Gateway SSRF and native file access with gRPC

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier...

PT-2026-82797

Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings,...

PT-2026-82781

A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication o...

PT-2026-82398

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier...

PT-2026-82552

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an...

PT-2026-82791

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...

PT-2026-82449

Name of the Vulnerable Software and Affected Versions Apache APISIX version 3.17.0 Description An inefficient algorithmic complexity issue exists where a single small request can cause a gateway worker to reach 100% CPU usage for an extended period when using graphql-limit-count routes...

DRUPAL-CONTRIB-2026-106

This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...

CVE-2026-71327

A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. Its Kubernetes Gateway API provider incorrectly generates unique identifiers for routes and services. This vulnerability allows an attacker to create conflicting routes, which can then overwrite the backend services...

Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service...

Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...

CVE-2026-65091

NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-65091

NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-65091

NVIDIA OpenShell (all platforms) is affected by an OS command injection vulnerability exploitable through a malicious gateway. A successful exploit could result in code execution, data tampering, and information disclosure . The vendor-assigned CVSS v3.1 score is 8.8 (High) , reflecting a network...

EUVD-2026-66090

NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-55618

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, the cleanfounduri function in emlparser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash,...

CVE-2026-55618

eml_parser is a Python module for parsing .eml files. Prior to 3.0.2 , the clean_found_uri function in parser.py validates potential URL strings before unescaping HTML entities for colon, slash, or period characters. As a result, valid encoded URLs and their hostnames are rejected and omitted fro...