CVE-2026-9322

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request...

CVE-2026-54722

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...

Updated nghttp2 packages fix a security vulnerability

The updated packages fix a security vulnerability: HTTP Request/Response Smuggling via Upgrade Request with Content-Length. CVE-2026-58055...

EUVD-2026-51199

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

EUVD-2026-51245

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to filegetcontents in the Blueprints::import method without path validation. Attackers can...

CVE-2026-66415

Leantime 3.6.2 is affected by a Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI) vulnerability in Blueprints::import(). An authenticated attacker can pass unsanitized user-supplied filenames to file_get_contents(), without path validation, to read internal resources. Attacks can ...

SUSE CVE-2026-48824

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes" wrapped only POST /api/v1/send with http.MaxBytesReader. The...

SUSE CVE-2026-49396

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim's agents. This issue has been patched in version 2.0.14...

SUSE CVE-2026-55434

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.33.0 and prior to versions 2.33.8 and 2.34.2, AI Bridge provider handlers read request bodies with io.ReadAll without a maximum size so an authenticated user with AI Bridge access could se...

SUSE CVE-2026-58424

Permanent Fork PR Workflow Approval Gate Bypass...

CVE-2026-54722

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...

CVE-2026-57862

Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through the web link...

EUVD-2026-51230

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request...

EUVD-2026-51180

Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which fixes this issue...

EUVD-2026-51177

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...

CVE-2026-57862

CVE-2026-57862 affects Kanboard 1.2.52 and earlier. The SSRF bypass arises when authenticated users submit hexadecimal-encoded IPs via user-controlled URLs, causing cURL to resolve internal resources. The isPrivateURL() filter in app/Core/Http/Client.php is considered safe due to FILTER_VALIDATE_...

CVE-2026-57862

Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through the web link...

CVE-2026-57862 Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation

Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through the web link...

EUVD-2026-51164

Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through the web link...

CVE-2026-11897

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources...