CVE-2026-77274 MCP Atlassian: SSRF Protection Bypass

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validateurlforssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL...

CVE-2026-80148

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the...

CVE-2026-80150

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the...

EUVD-2026-84536

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

CVE-2026-75511 Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

CVE-2026-75511 Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

CVE-2026-80150 Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the...

EUVD-2026-84515

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH...

CVE-2026-80149 Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the...

CVE-2026-80149

CVE-2026-80149 is a server-side request forgery (SSRF) vulnerability in the WebSSH/WebTelnet listener of Lantronix Autonomous Out-of-Band devices. The affected products are the SLC8000 (before firmware v9.7.0.3), EMG8500/EMG7500 (before firmware v9.7.0.1), and all firmware versions of the SLB882 ...

CVE-2026-80148 Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the...

CVE-2026-80148 Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the...

EUVD-2026-84514

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH...

CVE-2026-80148

Lantronix autonomous out-of-band devices (SLC8000, EMG8500, EMG7500, SLB882) contain a server-side request forgery (SSRF) in the WebSSH/WebTelnet listener . The custom shellinaboxd binary builds the SSH connection target using a snprintf call with user-supplied input; by supplying an overlong use...

PT-2026-96804

Name of the Vulnerable Software and Affected Versions SLC8000 versions prior to 9.7.0.3 SLC9000 versions prior to 9.7.0.2 EMG8500/EMG7500 versions prior to 9.7.0.1 SLB882 affected versions not specified Description A server-side request forgery issue exists in the WebSSH/WebTelnet listener...

PT-2026-96805

Name of the Vulnerable Software and Affected Versions SLC8000 versions prior to 9.7.0.3 SLC9000 versions prior to 9.7.0.2 EMG8500/EMG7500 versions prior to 9.7.0.1 SLB882 affected versions not specified Description A server-side request forgery SSRF issue exists in the WebSSH/WebTelnet listener...

CVE-2026-95623: Server-Side Request Forgery (SSRF)

The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This...

CVE-2026-80148: Server-Side Request Forgery (SSRF)

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the...

PT-2026-96789

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.18.0 Description Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl. These values are processed through...

PT-2026-97057

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.10 Mattermost versions 11.8.0 through 11.8.5 Mattermost versions 11.9.0 through 11.9.1 Mattermost versions 11.10.0 through 11.10.1 Description The software fails to apply the internal-connection filter t...