Lucene search
+L

19047 matches found

Fedora
Fedora
added 2026/06/29 12:58 a.m.17 views

[SECURITY] Fedora 44 Update: prometheus-podman-exporter-1.21.1-1.fc44

Prometheus exporter for podman environments exposing containers, pods, images, volumes and networks information...

7.5CVSS6.7AI score0.00651EPSS
SaveExploits1
Positive Technologies
Positive Technologies
added 2026/06/29 12:00 a.m.47 views

PT-2026-53283

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2025.5.0 Description The iOS companion app fails to respect the SSID allowlist for internal networks. While the app typically uses the Service Set Identifier SSID—the public name of a wireless network—to...

7.5CVSS5.8AI score0.00258EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/27 12:00 a.m.58 views

PT-2026-53221

Name of the Vulnerable Software and Affected Versions Delta Electronics DTM Soft affected versions not specified Description The software is susceptible to the deserialization of untrusted data, which can allow an attacker to execute arbitrary code. Real-world exploitation has been observed where...

8.4CVSS6AI score0.00375EPSS
SaveExploits0References8
Github Security Blog
Github Security Blog
added 2026/06/26 9:29 p.m.27 views

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Summary The web UI /ui/ does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator for example, one created via self-registration or OIDC can access resources belonging to other operators. Impact A non-admin operator can: - Block...

8.8CVSS5.8AI score0.00283EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/06/26 9:29 p.m.21 views

GHSA-C6V2-3FFM-VCMC Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Summary The web UI /ui/ does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator for example, one created via self-registration or OIDC can access resources belonging to other operators. Impact A non-admin operator can: - Block...

8.8CVSS5.8AI score0.00283EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/26 9:29 p.m.12 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the web UI handlers responsible for managing hosts and networks. An attacker can gain unauthorized access to sensitive information and perform destructive actions across resources owned by other operators by...

8.8CVSS6AI score0.00283EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/06/26 9:29 p.m.19 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the web UI handlers responsible for managing hosts and networks. An attacker can gain unauthorized access to sensitive information and perform destructive actions across resources owned by other operators by...

8.8CVSS5.8AI score0.00283EPSS
SaveExploits0References3
OSV
OSV
added 2026/06/26 7:48 p.m.15 views

GHSA-VGRC-HQ28-P3XP Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF

Summary Hysteria's UDP relay treats the destination address as packet-scoped, but ACL and outbound policy are applied only once when a new UDP session is created. After an authenticated client opens a UDP session using an allowed first destination, later packets in the same Session ID can be sent...

7.4CVSS5.9AI score
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/06/26 7:17 p.m.18 views

pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)

Summary When an application using Pydantic AI opts a URL into forcedownload='allow-local' which disables the default block on private/internal IPs and runs on a network that routes the affected IPv6 transition forms NAT64- or ISATAP-configured networks, the cloud-metadata blocklist could be...

6.8CVSS5.8AI score0.00419EPSS
SaveExploits0References6Affected Software2
OSV
OSV
added 2026/06/26 7:17 p.m.20 views

GHSA-CG7W-RG45-PC59 pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)

Summary When an application using Pydantic AI opts a URL into forcedownload='allow-local' which disables the default block on private/internal IPs and runs on a network that routes the affected IPv6 transition forms NAT64- or ISATAP-configured networks, the cloud-metadata blocklist could be...

6.8CVSS5.8AI score0.00322EPSS
SaveExploits0References6
Snyk
Snyk
added 2026/06/26 6:15 p.m.15 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the image import process. An attacker can interact with internal network infrastructure and perform error-based port scanning by supplying a crafted URL to the /images endpoint, which causes the daemo...

5.3CVSS5.8AI score0.00278EPSS
SaveExploits1References2
UbuntuCve
UbuntuCve
added 2026/06/26 5:16 p.m.15 views

CVE-2026-28385

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery SSRF vulnerability in the image import functionality allows authenticated users with the cancreateimages entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a...

5CVSS6.1AI score0.00278EPSS
SaveExploits1References3
EUVD
EUVD
added 2026/06/26 4:23 p.m.18 views

EUVD-2026-39805

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery SSRF vulnerability in the image import functionality allows authenticated users with the cancreateimages entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a...

5CVSS5.8AI score0.00278EPSS
SaveExploits1References2
Debian CVE
Debian CVE
added 2026/06/26 4:23 p.m.17 views

CVE-2026-28385

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery SSRF vulnerability in the image import functionality allows authenticated users with the cancreateimages entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a...

5CVSS5.8AI score0.00278EPSS
SaveExploits1
EUVD
EUVD
added 2026/06/26 3:32 p.m.17 views

EUVD-2026-39779

Mattermost versions 10.11.x = 10.11.18, 11.6.x = 11.6.3, 11.5.x = 11.5.6 fail to validate attachment URLs against internal or private IP ranges in the Mattermost Agents plugin MCP server which allows an attacker with access to the MCP server in stdio mode to perform server-side request forgery SS...

6.5CVSS5.8AI score0.00139EPSS
SaveExploits0References2
NVD
NVD
added 2026/06/26 3:16 p.m.18 views

CVE-2026-4339

Mattermost versions 10.11.x = 10.11.18, 11.6.x = 11.6.3, 11.5.x = 11.5.6 fail to validate attachment URLs against internal or private IP ranges in the Mattermost Agents plugin MCP server which allows an attacker with access to the MCP server in stdio mode to perform server-side request forgery SS...

6.5CVSS0.00139EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.26 views

PT-2026-53023

Name of the Vulnerable Software and Affected Versions Aimeos Pagible versions prior to 0.10.4 Description The administrative proxy route /cmsproxy is susceptible to Server-Side Request Forgery SSRF through DNS Rebinding. This occurs due to a Time-of-Check to Time-of-Use TOCTOU race condition—a...

3CVSS5.3AI score0.00131EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.68 views

PT-2026-53022

Name of the Vulnerable Software and Affected Versions Nebula Mesh affected versions not specified Description The web UI /ui/ fails to apply per-operator Certificate Authority CA scoping. This allows any authenticated non-admin operator to access, block, or delete resources belonging to other...

8.8CVSS6AI score0.00283EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.24 views

PT-2026-52849

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.12 through 6.9 Description A Server-Side Request Forgery SSRF issue exists in the image import functionality. Authenticated users possessing the can create images entitlement can interact with internal network...

5CVSS6AI score0.00278EPSS
SaveExploits1References12
RedhatCVE
RedhatCVE
added 2026/06/25 11:23 p.m.26 views

CVE-2026-13318

A server-side request forgery SSRF flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance VMI, virt-api reads the target IP from vmi.Status.Interfaces0.IP and passes it directly to net.Dial without validation. For VMIs using...

6.4CVSS6AI score0.00236EPSS
SaveExploits0References3
Rows per page
Query Builder