21 matches found
CVE-2026-7754
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery SSRF due to insecure default configuration and incomplete enforcement of the SSRF protection mechanism...
PT-2026-60859
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description An issue exists due to insecure default configuration and incomplete enforcement of the server-side request forgery SSRF protection mechanism. SSRF is a flaw that allows an attacker to...
CVE-2026-22874
Gitea up to version 1.26.2 has incomplete SSRF protection in webhook and migration allow-list filtering (CVE-2026-22874). Affected: Gitea 1.26.x prior to 1.26.3. The issue exposes SSRF risk due to insufficient filtering in webhook and migration allow-list mechanisms. Patches addressing this belon...
CVE-2024-2339 Improper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule
PostgreSQL Anonymizer v1.2 contains a vulnerability that allows a user who owns a table to elevate to superuser. A user can define a masking function for a column and place malicious code in that function. When a privileged user applies the masking rules using the static masking or the anonymous...
Dolibarr remote PHP code execution
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shellexec are blocked but backticks are not blocked...
Server-Side Request Forgery in calibreweb
calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery SSRF. This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to localhost...
CVE-2021-33816
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shellexec are blocked but backticks are not blocked...
CVE-2021-33816
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shellexec are blocked but backticks are not blocked...
Code injection
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shellexec are blocked but backticks are not blocked...
CVE-2021-33816
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shellexec are blocked but backticks are not blocked...
CVE-2021-33816
CVE-2021-33816 affects Dolibarr 13.0.2: the website builder module enables remote PHP code execution because the protection mechanism blocks system, exec, and shell_exec but does not block backticks. This is the underlying root cause described across multiple sources (no public remediation detail...
CVE-2021-43188
In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete...
CVE-2021-43188
In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete...
Input validation
In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete...
Design/Logic Flaw
In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete...
CVE-2021-43189
In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete...
CVE-2021-43189
In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete...
Debian DSA-4889-1 : mediawiki - security update
Multiple security issues were found in MediaWiki, a website engine for collaborative work, which could result in incomplete page/blocking protection, denial of service or cross-site scripting. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...