PT-2026-91430

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation...

The vulnerability of SAP NetWeaver Application Server ABAP software integration platforms lies in insufficient validation of incoming requests. This allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of SAP NetWeaver Application Server ABAP software integration platforms is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

The vulnerability of the RoundCube Webmail email client, related to insufficient validation of requests on the server side, allows a hacker to execute an SSRF attack.

The vulnerability of the RoundCube Webmail email client is related to insufficient validation of requests at the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

ROS-20260907-73-0057

The vulnerability in Erlang is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to perform a SSRF attack remotely...

SUSE CVE-2026-84377

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...

CVE-2026-84377

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...

CVE-2026-84377 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...

ROS-20260901-73-0026

The vulnerability in php-phpseclib is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to perform SSRF attacks remotely...

The vulnerability of the software platform for conducting marketing campaigns in Adobe Campaign Classic lies in the insufficient validation of incoming requests, allowing a hacker to execute arbitrary code.

The vulnerability of the software platform for conducting marketing campaigns in Adobe Campaign Classic is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

The vulnerabilities of the functions pathsec.urlopen(), nltk.data.load(), Downloader.index(), and Downloader.download() in the NLTK library for symbolic and statistical processing of natural language allow attackers to perform SSRF attacks.

The vulnerabilities of the functions pathsec.urlopen, nltk.data.load, Downloader.index, and Downloader.download in the NLTK library for symbolic and statistical processing of natural language are related to insufficient validation of requests on the server side. Exploiting these vulnerabilities...

CVE-2026-71864: Improper Control of Generation of Code

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...

The vulnerability of the Content Credentials SDK library lies in its insufficient validation of incoming requests, allowing attackers to circumvent existing security restrictions.

The vulnerability of the Content Credentials SDK libraries is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions remotely...

Linux Distros Unpatched Vulnerability : CVE-2026-73502

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial...

CVE-2026-71865: Improper Control of Generation of Code

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...

DEBIAN-CVE-2026-73502

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

CVE-2026-73502 kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

CVE-2026-73502

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

CVE-2026-73502 kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

CVE-2026-73502 kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

EUVD-2026-61009

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...