CVE-2026-75054

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects...

EUVD-2026-60253

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects...

CVE-2026-75054

JetBrains IntelliJ IDEA before 2026.2.1 is vulnerable to server-side request forgery (SSRF) via the OpenAPI preview proxy when processing untrusted projects. The flaw allows internal network probing and potential access to local services, with HIGH confidentiality impact and MEDIUM CVSS 6.3 sever...

CVE-2026-75054

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects...

CVE-2026-75054

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects...

CVE-2026-75054

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects...

CVE-2026-73851

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

EUVD-2026-60233

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

CVE-2026-73851

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

CVE-2026-73851

CVE-2026-73851 is a path traversal vulnerability in Microsoft Kiota , an OpenAPI-based HTTP client code generator. When Kiota generates AI plugin manifests, the static_template.file reference written into the manifest is resolved by the AI host relative to the plugin package. The IsSafeFileRefere...

CVE-2026-73851 Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

CVE-2026-73851 Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

CVE-2026-73851: Improper Limitation of a Pathname to a Restricted Directory

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

CVE-2026-75054: Server-Side Request Forgery (SSRF)

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects...

PT-2026-76703

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects...

EUVD-2026-58504

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...

CVE-2026-72855

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...

CVE-2026-72855 Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...

CVE-2026-72855 Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...

CVE-2026-72855 Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...