EUVD-2026-87669

Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery SSRF vulnerability in the optional Elasticsearch driver plugins/drivers/elastic.php, fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect before the login result is validated, an...

CVE-2026-100681

Budibase versions prior to 3.45.0 are vulnerable to an unauthenticated server-side request forgery (SSRF) and credential exfiltration flaw within the Microsoft Teams webhook endpoint . The root cause is the acceptance of forged Bot Framework activities containing arbitrary serviceUrl values. An a...

EUVD-2026-87654

Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an...

CVE-2026-100646 SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent, on the incorrect assumptio...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Network component of Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via malicious network traffic. Chromium security severity: Medium...

CVE-2026-100527

Versions of OpenClaw prior to 2026.8.2 are vulnerable to a denial of service (DoS) flaw within the Browser extension relay . This issue allows unauthenticated network sources to exhaust pending-authentication capacity by maintaining silent WebSocket upgrades . By occupying every available pending...

CVE-2026-100696: Server-Side Request Forgery (SSRF)

Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery SSRF vulnerability in the optional Elasticsearch driver plugins/drivers/elastic.php, fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect before the login result is validated, an...

CVE-2026-100697: Server-Side Request Forgery (SSRF)

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin plugins/drivers/clickhouse.php, rewritten in 6.0.0 is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit authdriver=clickhouse with authserver set to an arbitrary U...

PT-2026-99367

Name of the Vulnerable Software and Affected Versions Adminer versions 4.16.0 through 6.0.1 Description A pre-authentication Server-Side Request Forgery SSRF exists in the optional Elasticsearch driver located at plugins/drivers/elastic.php. The issue occurs because adminer/include/auth.inc.php...

CVE-2026-5267

Ciena Navigator Network Control Suite NCS contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive...

CVE-2026-100373

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

5G-Shark Lures Phones to Rogue 5G Cells Without Network Jamming

Researchers have developed 5G-Shark to lure phones onto rogue base stations, collect subscriber IDs, force network downgrades and…...

EUVD-2026-87317

Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...

EUVD-2026-87316

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

CVE-2026-5267 Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS

Ciena Navigator Network Control Suite NCS contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive...

EUVD-2026-87295

Ciena Navigator Network Control Suite NCS contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive...

CVE-2026-5267 Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS

Ciena Navigator Network Control Suite NCS contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive...

CVE-2026-5267

The Ciena Navigator Network Control Suite (NCS) is affected by an information exposure vulnerability in its event-streaming API . The root cause is a failure to properly enforce authentication , which allows an unauthenticated attacker with network access to the affected service to access the eve...

CVE-2026-56734

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...