nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character

A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname...

Linux Distros Unpatched Vulnerability : CVE-2026-83813

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP...

CVE-2026-57114

PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhookurl when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound t...

EUVD-2026-108890

PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhookurl when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound t...

PT-2026-122230

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description In the twisted.names.dns.DNSDatagramProtocol, the system accepts UDP DNS responses for pending queries based solely on a matching 16-bit transaction ID without verifying the source host and port...

Twisted input validation error vulnerability

Versions of Twisted prior to 26.7.0rc1 contain an input validation error vulnerability. This vulnerability arises because twisted.names.dns.DNSDatagramProtocol only validates the 16-bit transaction ID without verifying whether the DNS response originates from the requested host and port. An...

CVE-2026-100373

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

CVE-2026-82638 jina-ai reader Server-Side Request Forgery via disabled private-address guard

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

Linux Distros Unpatched Vulnerability : CVE-2026-10582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL...

EUVD-2026-65443

Ech0 through 4.2.1 contains a server-side request forgery vulnerability in the validateWebhookURL function webhooksettingservice.go, which only validates literal IP addresses via net.ParseIP and fails to reject hostnames that DNS-resolve to private or internal IPs e.g., 169.254.169.254.nip.io. An...

SUSE CVE-2026-10582

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

CVE-2026-10582 Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

CVE-2026-10582 Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

EUVD-2026-53357

Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...

CVE-2026-57114

PraisonAI's Async Jobs API validates "webhookurl" when a job request is parsed and again when the internal "Job" object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, "sendwebhook" passes the original...

CVE-2026-63736 SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution

SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists without checking resolved IP addresses. An Owner role attacker can point an access method at an allow-listed hostname resolving to privat...

Updated rsync package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Rsync 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write. CVE-2026-29518 Rsync 3.4.3 Authorization Bypass via Hostname Resolution. CVE-2026-43617 Rsync 3.4.3 Integer Overflow Information Disclosure. CVE-2026-43618 Rsync 3.4.3...

[SECURITY] Fedora 43 Update: perl-Socket-2.041-1.fc43

This Perl module provides a variety of constants, structure manipulators and other functions related to socket-based networking. The values and functions provided are useful when used in conjunction with Perl core functions such as socket, setsockopt and bind. It also provides several other suppo...

[SECURITY] Fedora 44 Update: perl-Socket-2.041-1.fc44

This Perl module provides a variety of constants, structure manipulators and other functions related to socket-based networking. The values and functions provided are useful when used in conjunction with Perl core functions such as socket, setsockopt and bind. It also provides several other suppo...

PT-2026-61780

Name of the Vulnerable Software and Affected Versions praisonaiagents versions 1.6.39 and earlier PraisonAI versions 4.6.39 and earlier Description A Server-Side Request Forgery SSRF issue exists because the SSRF guard only validates literal IP address encodings and does not perform DNS resolutio...