SAP BusinessObjects Business Intelligence Platform - Blind Server-Side Request Forgery

SAP BusinessObjects Business Intelligence Platform Web Services 410, 420, and 430 is susceptible to blind server-side request forgery. An attacker can inject arbitrary values as CMS parameters to perform lookups on the internal network, which is otherwise not accessible externally. On successful...

EUVD-2026-62926

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../checkconnectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The...

CVE-2026-76361 Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../checkconnectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The...

CVE-2026-63642

A flaw was found in MagicMirror². A remote attacker can exploit an unauthenticated Socket.IO notification in the newsfeed module by providing a malicious, unvalidated URL. This allows for Server-Side Request Forgery SSRF, enabling the attacker to identify internal network hosts and ports, and...

CVE-2026-76225

ArcadeDB before 26.8.1 has a server-side request forgery flaw in its OpenCypher LOAD CSV implementation, which does not validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the server fetch and retu...

CVE-2026-56677

9Router 0.5.4 and earlier is vulnerable to unauthenticated SSRF: the POST /api/auth/oidc/test endpoint passes a user-supplied issuerUrl to fetchOidcDiscovery() without blocking private/loopback IPs, allowing internal service scanning and reflection of OIDC discovery fields (token_endpoint, jwks_u...

Important: Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

A Subscription Management tool for finding and reporting Red Hat product usage Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their...

CVE-2026-70467

A server-side request forgery ssrf vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all...

CVE-2026-72597

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

CVE-2026-72597

CVE-2026-72597 affects Friendica (2026.08-dev branch). The vulnerability is a server-side request forgery (SSRF) in the link-preview endpoint, which fetches a user-provided URL without an internal IP deny list. This allows an authenticated user with a free self-registered account to probe interna...

EUVD-2026-56036

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

CVE-2026-72597 Friendica Friendica - Server-Side Request Forgery

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

onyx-agent

Onyx Agent v68 Multi-LLM agent framework for security testing...

Malicious code in mlflow-ui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7192c53fc1e0b62e2c373a8a6beabfeb3777cae3aacfe23ca374eab1c2839a7 The package impersonates the MLflow project author 'MLflow Community' , homepage https://github.com/mlflow/mlflow but provides no MLflow UI...

MAL-2026-10779 Malicious code in mlflow-ui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7192c53fc1e0b62e2c373a8a6beabfeb3777cae3aacfe23ca374eab1c2839a7 The package impersonates the MLflow project author 'MLflow Community' , homepage https://github.com/mlflow/mlflow but provides no MLflow UI...

[SECURITY] Fedora 43 Update: nmap-7.92-8.fc43

Nmap is a utility for network exploration or security auditing. It supports ping scanning determine which hosts are up, many port scanning techniques determine what services the hosts are offering, and TCP/IP fingerprinting remote host operating system identification. Nmap also offers flexible ta...

nmap-enumeration-lab

Network Scanning & Host Enumeration with Nmap Host discovery,...

[SECURITY] Fedora 44 Update: nmap-7.92-11.fc44

Nmap is a utility for network exploration or security auditing. It supports ping scanning determine which hosts are up, many port scanning techniques determine what services the hosts are offering, and TCP/IP fingerprinting remote host operating system identification. Nmap also offers flexible ta...

MAL-2026-6722 Malicious code in date-fns-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4694a079d83e33dcee7f87140c41737009d9f0b19f351c23f2ae3dbce9a47a51 [email protected] presents as a lightweight date-formatting utility but ships a malicious postinstall.js that runs automatically on npm install. T...

The vulnerability of the ipv6_get_data_primitive() function in the libnetutil/netutil.cc library, a networking scanning tool for Nmap, allows a hacker to cause a service failure.

The vulnerability of the ipv6getdataprimitive function in the libnetutil/netutil.cc library, a network scanning tool for Nmap, is related to a countable loss of significance. Exploiting this vulnerability could allow a remote attacker to cause a service failure...