GHSA-87MG-5GRR-RHWH Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Summary The Feed Reader front-end module passes RSS feed URLs from its configuration directly to $this-feedIo-read$url without any scheme validation or private-IP blocklist. A backend user with module-edit permissions can configure an arbitrary URL pointing to internal network services,...

Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Summary The Feed Reader front-end module passes RSS feed URLs from its configuration directly to $this-feedIo-read$url without any scheme validation or private-IP blocklist. A backend user with module-edit permissions can configure an arbitrary URL pointing to internal network services,...

EUVD-2026-51596

Contao: Server-Side Request Forgery SSRF via Unvalidated RSS Feed URL in Feed Reader Module...

CVE-2026-77420

A flaw was found in JLine, a Java library for handling console input. An attacker who can control application or user configuration can supply a specially crafted regular expression to the HISTORYIGNORE configuration variable. This malicious input can cause excessive CPU consumption when commands...

ch.epfl.lara:scala3-language-server_3 (>=3.9.0-rc1-bin-20260516-64de706-nightly, <=3.10.0-rc1-bin-20260720-513d792-nightly), ch.epfl.lara:scala3-repl_3 (>=3.9.0-rc1-bin-20260516-64de706-nightly, <=3.10.0-rc1-bin-20260720-513d792-nightly) +46 more potentially affected by CVE-2026-77420 via org.jline:jline-reader (>=4.0.0, <=4.3.0)

org.jline:jline-reader MAVEN version =4.0.0, =3.9.0-rc1-bin-20260516-64de706-nightly, =3.9.0-rc1-bin-20260516-64de706-nightly, =3.9.0-rc1-bin-20260516-64de706-nightly, =26.4.2, =26.4.2, =9.4.3, =9.4.3, =9.4.3, =3.9.0-rc5-p11, =3.9.0-rc5-p11, =2.54.0, =2.54.0, =2.55.0 and more Source cves:...

ch.epfl.lara:scala3-language-server_3 (>=3.9.0-rc1-bin-20260516-64de706-nightly, <=3.10.0-rc1-bin-20260720-513d792-nightly), ch.epfl.lara:scala3-repl_3 (>=3.9.0-rc1-bin-20260516-64de706-nightly, <=3.10.0-rc1-bin-20260720-513d792-nightly) +46 more potentially affected by CVE-2026-77420 via org.jline:jline-reader (>=4.0.0, <=4.3.0)

org.jline:jline-reader MAVEN version =4.0.0, =3.9.0-rc1-bin-20260516-64de706-nightly, =3.9.0-rc1-bin-20260516-64de706-nightly, =3.9.0-rc1-bin-20260516-64de706-nightly, =26.4.2, =26.4.2, =9.4.3, =9.4.3, =9.4.3, =3.9.0-rc5-p11, =3.9.0-rc5-p11, =2.54.0, =2.54.0, =2.55.0 and more Source cves:...

ch.epfl.lara:scala3-language-server_3 (>=3.9.0-rc1-bin-20260516-64de706-nightly, <=3.10.0-rc1-bin-20260720-513d792-nightly), ch.epfl.lara:scala3-repl_3 (>=3.9.0-rc1-bin-20260516-64de706-nightly, <=3.10.0-rc1-bin-20260720-513d792-nightly) +46 more potentially affected by CVE-2026-77420 via org.jline:jline-reader (>=4.0.0, <=4.3.0)

org.jline:jline-reader MAVEN version =4.0.0, =3.9.0-rc1-bin-20260516-64de706-nightly, =3.9.0-rc1-bin-20260516-64de706-nightly, =3.9.0-rc1-bin-20260516-64de706-nightly, =26.4.2, =26.4.2, =9.4.3, =9.4.3, =9.4.3, =3.9.0-rc5-p11, =3.9.0-rc5-p11, =2.54.0, =2.54.0, =2.55.0 and more Source cves:...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +4719 more potentially affected by CVE-2026-77420 via org.jline:jline-reader (>=3.2.0, <=3.30.14)

org.jline:jline-reader MAVEN version =3.2.0, =0.14.1, =0.1.0, =0.9.6, =0.15.3, =0.12.0, =0.9.6, =0.15.3, =0.9.6, =0.9.6, =0.15.3, =0.9.6, =0.15.3, =0.14.1, =0.9.6, =0.14.3 and more Source cves: CVE-2026-77420 Source advisory: GHSA-5Q95-HRPC-M3W3...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +4719 more potentially affected by CVE-2026-77420 via org.jline:jline-reader (>=3.2.0, <=3.30.14)

org.jline:jline-reader MAVEN version =3.2.0, =0.14.1, =0.1.0, =0.9.6, =0.15.3, =0.12.0, =0.9.6, =0.15.3, =0.9.6, =0.9.6, =0.15.3, =0.9.6, =0.15.3, =0.14.1, =0.9.6, =0.14.3 and more Source cves: CVE-2026-77420 Source advisory: SNYK:JAVA-ORGJLINE-20079472...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +4719 more potentially affected by CVE-2026-77420 via org.jline:jline-reader (>=3.2.0, <=3.30.14)

org.jline:jline-reader MAVEN version =3.2.0, =0.14.1, =0.1.0, =0.9.6, =0.15.3, =0.12.0, =0.9.6, =0.15.3, =0.9.6, =0.9.6, =0.15.3, =0.9.6, =0.15.3, =0.14.1, =0.9.6, =0.14.3 and more Source cves: CVE-2026-77420 Source advisory: OSV:GHSA-5Q95-HRPC-M3W3...

JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

Summary The JLine3 HISTORYIGNORE variable is converted into a Java regular expression with only partial escaping. As a result, regex metacharacters other than and : are passed through to the regex engine. A crafted value such as a++b can cause catastrophic backtracking each time a command line is...

ch.epfl.lara:scala3-language-server_3 (>=3.9.0-rc1-bin-20260516-64de706-nightly, <=3.10.0-rc1-bin-20260720-513d792-nightly), ch.epfl.lara:scala3-repl_3 (>=3.9.0-rc1-bin-20260516-64de706-nightly, <=3.10.0-rc1-bin-20260720-513d792-nightly) +46 more potentially affected by CVE-2026-77420 via org.jline:jline-reader (>=4.0.0, <=4.3.0)

org.jline:jline-reader MAVEN version =4.0.0, =3.9.0-rc1-bin-20260516-64de706-nightly, =3.9.0-rc1-bin-20260516-64de706-nightly, =3.9.0-rc1-bin-20260516-64de706-nightly, =26.4.2, =26.4.2, =9.4.3, =9.4.3, =9.4.3, =3.9.0-rc5-p11, =3.9.0-rc5-p11, =2.54.0, =2.54.0, =2.55.0 and more Source cves:...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +4719 more potentially affected by CVE-2026-77420 via org.jline:jline-reader (>=3.2.0, <=3.30.14)

org.jline:jline-reader MAVEN version =3.2.0, =0.14.1, =0.1.0, =0.9.6, =0.15.3, =0.12.0, =0.9.6, =0.15.3, =0.9.6, =0.9.6, =0.15.3, =0.9.6, =0.15.3, =0.14.1, =0.9.6, =0.14.3 and more Source cves: CVE-2026-77420 Source advisory: MEND:CVE-2026-77420...

CVE-2026-77420 JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatternsString patterns, String line in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORYIGNORE configuration value into a Java regular expression...

EUVD-2026-85528

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatternsString patterns, String line in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORYIGNORE configuration value into a Java regular expression...

CVE-2026-91817

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash...

CVE-2026-91818

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash...

CVE-2026-91814

A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the...

CVE-2026-91810

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash...

CVE-2026-91815

Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution...