CVE-2026-85699: Server-Side Request Forgery (SSRF)

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the...

CVE-2026-85686: Server-Side Request Forgery (SSRF)

ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...

CVE-2026-84066: Missing Authorization

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...

PT-2026-85650

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix missing metadata reservation for large xattrs BUG lsetxattr panics the kernel when setting a large xattr value on a fragmented filesystem where the file already has an external xattr block. CAUSE ocfs2 calc xattr set...

PT-2026-85800

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ocfs2 read blocks function regarding buffer head management. The function incorrectly assumes that the buffer head returned by sb getblk is exclusively owned,...

CVE-2026-80809: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix missing metadata reservation for large xattrs BUG lsetxattr panics the kernel when setting a large xattr value on a fragmented filesystem where the file already has an external xattr block. CAUSE ocfs2calcxattrsetneed...

CVE-2026-80881: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix buffer head management in ocfs2readblocks In ocfs2readblocks, caller should't assume that buffer head returned by 'sbgetblk' is exclusively owned and so 'putbh' always drops bcount from 1 to 0. If it is not so, buffer...

PT-2026-85559

Name of the Vulnerable Software and Affected Versions OGX formerly Llama Stack versions up to commit fbe8e0f Description An unauthenticated server-side request forgery SSRF exists in the OpenAI-compatible 'POST /v1/responses' endpoint. The issue occurs because MCP tool definitions accept a server...

CVE-2026-85608: Server-Side Request Forgery (SSRF)

DouyinTikTokDownloadAPI through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/videodata endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services including...

EUVD-2026-57465

SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents...

MINI-47W9-H2RR-CJR6

Bulletin has no description...

EUVD-2026-52273

SiYuan: Cross-boundary metadata disclosure via getBlockInfo publish mode: reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered...

GHSA-PM3W-VXP9-CCWC SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

CVE: This vulnerability corresponds to CVE-2026-68585. Summary The /api/block/getBlockInfo endpoint returns document root metadata including the document title rootTitle for a block in a publish-forbidden document, with no publish-access check. Its sibling /api/block/getDocInfo applies the...

SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

CVE: This vulnerability corresponds to CVE-2026-68585. Summary The /api/block/getBlockInfo endpoint returns document root metadata including the document title rootTitle for a block in a publish-forbidden document, with no publish-access check. Its sibling /api/block/getDocInfo applies the...

CVE-2026-83497

creationtimestamp| type| source ---|---|--- 2026-09-03 20:32:54+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3muncbakmfo25...

CVE-2026-78595

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent...

CVE-2026-78595 Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent...

CVE-2026-78595

CVE-2026-78595 is a Missing Authorization (CWE-862) vulnerability in the Kibana Fleet feature that enables cross-space information disclosure. An authenticated user with only read-level Fleet agent privileges in one Kibana space can enumerate agent metadata and access diagnostic content belonging...

EUVD-2026-70659

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent...

Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-153)

Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticate...