PYSEC-2026-3733

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen and callers nltk.data.load, nltk.downloader.Downloader.index/download when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables...

CVE-2026-78682 NLTK before 3.10.3 SSRF Protection Bypass via Proxy

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen and callers nltk.data.load, nltk.downloader.Downloader.index/download when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables...

CVE-2026-71428: URL Redirection to Untrusted Site

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partitionhtml, and partitionmd is fetched without host validation in...

CVE-2026-48858

A flaw was found in Erlang/OTP's FTP File Transfer Protocol client, specifically within the ftpinternal module. A remote attacker, by operating a malicious or compromised FTP server, could exploit an unvalidated IP address in the server's passive mode PASV response. This vulnerability, known as...

CVE-2026-25960

A flaw was found in vLLM, an inference and serving engine for large language models LLMs. A remote attacker can exploit this Server-Side Request Forgery SSRF bypass vulnerability in the loadfromurlasync method. The flaw occurs because the URL validation and the actual HTTP request handling use...

CVE-2025-36743 SolarEdge SE3680H - Exposed Debug interface

SolarEdge SE3680H has an exposed debug/test interface accessible to unauthenticated actors, allowing disclosure of system internals and execution of debug commands...

CVE-2025-36743

CVE-2025-36743 concerns the SolarEdge SE3680H inverter, where an exposed debug/test interface is reachable by unauthenticated actors. Redundant exposure could lead to disclosure of internal system information and execution of debug commands, indicating a potential impact on confidentiality, integ...

PT-2025-50934

SolarEdge SE3680H has an exposed debug/test interface accessible to unauthenticated actors, allowing disclosure of system internals and execution of debug commands...

CVE-2025-50234

MCCMS v2.7.0 has an SSRF vulnerability located in the index method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypted using the sysauth$pic, 1 function, which utilizes a hard-coded key McEncryptionKey bD2voYwPpNuJ7B8, defined in the...

Linux Kernel Resource Management Error Vulnerability (CNVD-2023-54414)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux Kernel that originates from a corruption of the iscsiswtcpsessioncreate instruction responsible for freeing memory in the SCSI...

CVE-2017-16854

In Open Ticket Request System OTRS through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can use the ticket search form to disclose internal article information of their customer tickets...