PT-2026-98948

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description During federated authentication OAuth, OIDC, or SAML, the system fetches a profile image URL from an external identity provider without verifying the target address. An actor with control over their...

PT-2026-98938

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description An authorization bypass exists where a customer with access to a ticket can download attachments from internal ticket articles. While the article listing API correctly hides internal articles, the...

PT-2026-98856

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Internal REST service-account passwords are stored in a reversible plaintext-equivalent format. An authenticated attacker with access to these stored credentials could recover the password ...

PT-2026-99101

Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 2.0.3 Description An issue exists in the URLValidator.validateURL function where DNS hostnames are not properly resolved and internal addresses are not correctly validated. This allows users with permissions to...

CVE-2026-100373: Server-Side Request Forgery (SSRF)

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

PT-2026-99111

Name of the Vulnerable Software and Affected Versions MediaFlow Proxy versions prior to 2.5.0 Description An issue exists in the '/proxy' endpoint where missing and incomplete destination validation of the d query parameter allows for server-side request forgery SSRF. This occurs when a server is...

Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Summary The Feed Reader front-end module passes RSS feed URLs from its configuration directly to $this-feedIo-read$url without any scheme validation or private-IP blocklist. A backend user with module-edit permissions can configure an arbitrary URL pointing to internal network services,...

CVE-2026-85738

TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a...

CVE-2026-13248

An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version...

EUVD-2026-86342

TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a...

CVE-2026-77294 TREK: Server-Side Request Forgery via User-Configurable LLM Base URL

TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llmbaseurl through the settings API when the LLMPARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted impo...

CVE-2026-79764

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts an authenticated user's url query parameter and passes it to http.get or https.get without destination restrictions. In...

CVE-2026-79760

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests...

CVE-2026-77581

BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js uses isPrivateOrReservedHost to validate a supplied hostname separately from the DNS resolution used by fetchtargetUrl, allowing an...

EUVD-2026-86199

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts an authenticated user's url query parameter and passes it to http.get or https.get without destination restrictions. In...

CVE-2026-79764 Termix: Authenticated SSRF via `/homepage/proxy` — No Destination Allowlist

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts an authenticated user's url query parameter and passes it to http.get or https.get without destination restrictions. In...

CVE-2026-79760 Termix: Authenticated blind SSRF through notification channel test endpoints

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests...

CVE-2026-79760 Termix: Authenticated blind SSRF through notification channel test endpoints

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests...

CVE-2026-77581 BentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass

BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js uses isPrivateOrReservedHost to validate a supplied hostname separately from the DNS resolution used by fetchtargetUrl, allowing an...

CVE-2026-77581 BentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass

BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js uses isPrivateOrReservedHost to validate a supplied hostname separately from the DNS resolution used by fetchtargetUrl, allowing an...