CVE-2026-65925

CVE-2026-65925 describes a Server-Side Request Forgery (SSRF) in JFrog Artifactory when using the Cargo remote repository. A user with read access to the Cargo remote repository could cause Artifactory to request unintended URLs and return the response. The CVSS 3.1 vector is NETWORK, PRIVILEGES ...

CVE-2026-65925 Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

CVE-2026-65925

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

CVE-2026-65925 Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

EUVD-2026-49577

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six

CVE-2025-64512 - pdfminer.six Remote Code Execution RCE !...

OSEC-2026-11 Out of order segment reassembly allows remote denial of service

A remote peer that completes a normal TCP handshake can send a stream of small out-of-order segments that never fill the gap at rcvnxt. utcp keeps one reassembly entry per segment bounded per connection only by the receive window, about 65000 one-byte entries and re-folds the whole queue on every...

CVE-2026-56748

Cribl Stream (before 4.18.2) is affected by an improper validation of symbolic links in the Pack Git import feature. A remote authenticated attacker with Pack import and pipeline preview permissions can trigger arbitrary code execution as the Cribl server process by delivering a crafted Git repos...

CVE-2026-56748 Authenticated RCE via Symlink Following in Cribl Stream Pack Git Import

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link...

EUVD-2026-49570

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link...

CVE-2026-56748 Authenticated RCE via Symlink Following in Cribl Stream Pack Git Import

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link...

EUVD-2026-49567

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

CVE-2026-56747 Code Injection in JSON Pointer Processing Component in Cribl Stream

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

CVE-2026-56747 Code Injection in JSON Pointer Processing Component in Cribl Stream

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

CVE-2026-56747

Cribl Stream before 4.18.2 is affected by an improper control of code generation in the JSON Pointer-to-accessor compiler. The vulnerability allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pa...

DEBIAN-CVE-2026-66758

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an...

CVE-2026-66758

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an...

CVE-2026-10683

In the Synopsys DesignWare I2C driver drivers/i2c/i2cdw.c operating in target/slave mode, the rxfull interrupt handler gates the writerequested callback on dw-state != CMDSEND, and dw-state is only reset to READY on a STOP interrupt. The STARTDET interrupt, whose handler in...

CVE-2026-16481

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

CVE-2026-16481

CVE-2026-16481 affects the cloud-healthcare-fhir-fetch-page tool in googleapis/mcp-toolbox. The vulnerability is a Server-Side Request Forgery (SSRF) that also exfiltrates credentials. The tool accepts an unvalidated pageURL and issues an HTTP GET via an authenticated client, with the transport a...