123748 matches found
CVE-2026-16567
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...
CVE-2026-16567
CVE-2026-16567 affects the Document Embedder WordPress plugin before version 2.3.1 . The plugin does not verify a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary documents—including private and draft ones—by enumer...
CVE-2026-16567 Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...
CVE-2026-55227
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...
EUVD-2026-66721
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...
CVE-2026-77573 Weblate: DNS rebinding in VCS operations allows server-side request forgery
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...
CVE-2026-77507
Weblate , a web-based continuous localization platform, is affected by an information disclosure vulnerability in its object-scoped RSS feeds prior to version 2026.8 . The root cause is that these feeds fail to enforce the permission checks applied elsewhere, allowing unauthorized users to read c...
CVE-2026-55228 Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning...
CVE-2026-55227
Weblate , a web-based localization tool, is affected by an information disclosure vulnerability in versions prior to 2026.7 . Several endpoints perform object lookups in a globally scoped manner rather than restricting them to projects the requesting user can access. As a result, they return HTTP...
CVE-2026-55227 Observable object existence disclosure in private Weblate projects via globally scoped object lookups
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...
CVE-2026-55227 Observable object existence disclosure in private Weblate projects via globally scoped object lookups
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...
CVE-2026-55227 Observable object existence disclosure in private Weblate projects via globally scoped object lookups
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...
EUVD-2026-66386
mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://::1/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a...
CVE-2026-80347
mcp-fetch (npm package @kazuph/mcp-fetch ) through version 1.6.3 contains a Server-Side Request Forgery (SSRF) flaw in its isSafeUrl guard. When a target URL uses an IPv6 literal such as http://[::1]/, the parsed hostname retains the surrounding brackets. The net.isIP check returns zero for the b...
CVE-2026-80347 mcp-fetch through 1.6.3 Server-Side Request Forgery via Unstripped IPv6 Literal Brackets
mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://::1/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a...
CVE-2026-80347 mcp-fetch through 1.6.3 Server-Side Request Forgery via Unstripped IPv6 Literal Brackets
mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://::1/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093157)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093157 advisory. GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page. Tenable has extracted the preceding description block...
PT-2026-82296
Name of the Vulnerable Software and Affected Versions Weblate versions prior to 2026.7 Description Several endpoints perform object lookups using a global scope instead of restricting the search to projects the user is authorized to access. Consequently, the system returns an HTTP 403 Forbidden...
GO-2026-6263 Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution in github.com/openshift-pipelines/pipelines-as-code
Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution in github.com/openshift-pipelines/pipelines-as-code...
GHSA-RG5Q-PP8P-F7JM PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
Summary praisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhook URLs by resolving the hostname and checking whether the IP is private. When DNS resolution fails socket.gaierror, the validator silently passes the URL via except socket.gaierror: pass. Additionally, even when...