SUSE CVE-2026-87595

Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

PT-2026-89384

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows unauthenticated attackers to archive application logs by making GET requests without CSRF token validation. Attackers can craft malicious...

PT-2026-89563

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 9.0 IBM WebSphere Application Server version 8.5 Description A denial of service issue exists where a remote attacker can send a specially-crafted HTTP request to an administrative endpoint. This action...

PT-2026-89565

Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller concrete/controllers/dialog/board/custom slot.php saveTemplate action. The action created a board slot proxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance...

JetBrains YouTrack < 2025.3.160480 / 2026.1.x < 2026.1.14047 Improper Access Control (CVE-2026-86498)

The version of JetBrains YouTrack installed on the remote host is prior to 2025.3.160480, or 2026.1.x prior to 2026.1.14047. It is, therefore, affected by an improper access control vulnerability: - In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 PUT requests on link sub-resources allowe...

PT-2026-89621

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description Cross-site request forgery CSRF allows a remote attacker to perform unauthorized actions. CSRF is a type of attack that tricks a victim into submitting a malicious request to a we...

PT-2026-89383

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticated attackers to modify any user's channel password by sending a GET request. Attackers can craft a malicious webpage tha...

CVE-2025-57231: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...

PT-2026-89599

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description An authenticated user can send a specially crafted request to write arbitrary files on the system. Recommendations At the moment, there is no information...

CVE-2026-89044: Inconsistent Interpretation of HTTP Requests

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

CVE-2026-88015: Integer Overflow or Wraparound

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

PT-2026-89523

Name of the Vulnerable Software and Affected Versions Netty versions 4.1.133.Final through 4.1.137.Final Netty versions 4.2.13.Final through 4.2.17.Final Description Improper validation of the final transfer coding in the Transfer-Encoding header allows attackers to perform request smuggling usin...

PT-2026-89574

Name of the Vulnerable Software and Affected Versions career-ops versions prior to 0.8.0 Description The local web dashboard web/ exposes /api routes that allow command spawning and user-file writing without validating the request origin or restricting clients to loopback addresses. This allows...

PT-2026-89562

Name of the Vulnerable Software and Affected Versions Amazon AWS Systems Manager Agent versions prior to 3.3.4851.0 Description A server-side request forgery SSRF issue exists in the port forwarding to remote hosts functionality. The software improperly validates equivalent address representation...

PT-2026-89564

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 9.0 IBM WebSphere Application Server version 8.5 Description A remote attacker can cause a denial of service by sending a specially-crafted request. This action triggers excessive resource consumption,...

ROS-20260910-73-0147

The vulnerability in Chromium is related to errors in handling HTTP requests. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-88884: Incorrect Authorization

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...

PT-2026-89395

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...

PT-2026-89702

Summary There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 Upgrade mechanism. Since Traefik moved to unencrypted HTTP/2 with prior knowledge Go 1.24, a client-initiated Upgrade: h2c request header and its connection-specific HTTP2-Settings header were...

PT-2026-89492

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...