Windows GDI+ Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows GDI+ allows an unauthorized attacker to execute code over a network...

Power BI Remote Code Execution Vulnerability

Improper input validation in Power BI allows an authorized attacker to execute code over a network...

Windows DHCP Client Denial of Service Vulnerability

Uncontrolled resource consumption in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network...

Microsoft SharePoint Server Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

Windows DNS Server Remote Code Execution Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows DNS allows an unauthorized attacker to execute code over a network...

Windows DNS Server Remote Code Execution Vulnerability

Out-of-bounds write in Windows DNS allows an unauthorized attacker to execute code over an adjacent network...

Windows DHCP Server Information Disclosure Vulnerability

Integer underflow wrap or wraparound in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network...

Windows HTTP Protocol Stack Tampering Vulnerability

Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network...

Windows DHCP Server Information Disclosure Vulnerability

Integer underflow wrap or wraparound in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network...

Microsoft Excel Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network...

CoPilot Chat Security Feature Bypass Vulnerability

No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network...

Microsoft SharePoint Server Spoofing Vulnerability

Improper control of generation of code 'code injection' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

.NET Denial of Service Vulnerability

Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network...

CVE-2026-73210 Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...

CVE-2026-73210 Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...

CVE-2026-73210

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...

CVE-2026-72598

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

CVE-2026-72597

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

CVE-2026-50236

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-72784

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...