PT-2026-86932

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...

CVE-2026-86539: Server-Side Request Forgery (SSRF)

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...

PT-2026-86927

Server-Side Request Forgery SSRF vulnerability in ash-project ash authentication oauth2 server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. public ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces th...

CVE-2026-86206

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...

CVE-2026-86206

A vulnerability in the N-able N-central internal API access control filter allows unauthorized access to internal APIs due to an access control bypass involving path confusion and forwarded header spoofing . The flaw arises because the Envoy proxy and Jetty web server interpret URIs with semicolo...

CVE-2026-86206 Access control filter bypass allows unauthorised access to APIs

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...

EUVD-2026-72023

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...

CVE-2026-86206 Access control filter bypass allows unauthorised access to APIs

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...

CVE-2026-86207

An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal only APIs...

EUVD-2026-72022

An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal only APIs...

CVE-2026-86207

A high-severity authentication bypass exists in N-able N-central versions prior to 2026.3 HF 3 (version 2026.3.1.13). The flaw resides in the UserTwoFactorLogin function, where a RemoteException during legacy two-factor authentication fails to clear a session binding. By chaining this with a path...

CVE-2026-86207 Authentication bypass leads to unauthorised access to N-central

An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal only APIs...

CVE-2026-86207 Authentication bypass leads to unauthorised access to N-central

An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal only APIs...

CVE-2026-86115

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...

EUVD-2026-71955

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...

CVE-2026-86123

SQL Chat is a database connectivity tool that exposes four unauthenticated API endpoints under /api/connection (specifically execute.ts and test.ts). These endpoints accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts, effective...

CVE-2026-86122

Rowboat through version 0.9.1 is affected by a Server-Side Request Forgery (SSRF) vulnerability caused by insufficient validation of custom MCP server and webhook URLs. Authenticated users can configure these URLs to point at internal services and cloud metadata endpoints , enabling enumeration o...

EUVD-2026-71954

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network...

CVE-2026-86122 Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network...

CVE-2026-86122 Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network...