CLSA-2026-1794406235 TuxCare security update for guzzlehttp/guzzle (1 CVE)

TuxCare rebuilt guzzlehttp/guzzle to address 1 CVE. Fixed in 7.9.3-p2+tuxcare...

CLSA-2026-1794321543 TuxCare security update for guzzlehttp/guzzle (1 CVE)

TuxCare rebuilt guzzlehttp/guzzle to address 1 CVE. Fixed in 7.9.3-p1+tuxcare...

CVE-2026-124442

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg webhooks pointing to a redirecting URL,...

CVE-2026-124442 AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector Redirects

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg webhooks pointing to a redirecting URL,...

EUVD-2026-119558

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg webhooks pointing to a redirecting URL,...

CVE-2026-124442: AzuraCast: AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks…

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg webhooks pointing to a redirecting URL,...

CLEANSTART-2026-WR07211 Guzzle is an extensible PHP HTTP client

Security vulnerability affects the nextcloud package. Guzzle is an extensible PHP HTTP client...

CLEANSTART-2026-GH57522 Guzzle is an extensible PHP HTTP client

Security vulnerability affects the nextcloud package. Guzzle is an extensible PHP HTTP client...

CLEANSTART-2026-SK75094 Guzzle is an extensible PHP HTTP client

Security vulnerability affects the nextcloud package. Guzzle is an extensible PHP HTTP client...

CVE-2026-112288

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint validation and an internal address when Guzzle...

CVE-2026-112288 Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint validation and an internal address when Guzzle...

CVE-2026-112288

Krayin CRM versions 2.2.5 before 2.2.7 are vulnerable to a Server-Side Request Forgery (SSRF) filter bypass. The flaw resides in the WebhookService::isSafeEndpoint() validation logic, where an attacker can use DNS rebinding to bypass security checks. By returning a public address during validatio...

CVE-2026-112288 Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint validation and an internal address when Guzzle...

CVE-2026-112288 Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint validation and an internal address when Guzzle...

CVE-2026-112288: Server-Side Request Forgery (SSRF)

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint validation and an internal address when Guzzle...

CVE-2026-110761

The ILIAS platform (versions before 9.24 , 10.12 , and 11.5 ) is vulnerable to a PHP object injection vulnerability during the Test results import process. Authenticated users with permissions to create or import tests can exploit this by providing a crafted Test archive . The vulnerability occur...

CVE-2026-110761 ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import

ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tstsequence sequence attribute that is passed to...

EUVD-2026-101561

ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tstsequence sequence attribute that is passed to...

CVE-2026-110761: Deserialization of Untrusted Data

ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tstsequence sequence attribute that is passed to...

PT-2026-114125

ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst sequence sequence attribute that is passed to...