Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs. The submodule did not...

CVE-2026-18066

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery...

CVE-2026-18066 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery...

CVE-2026-18066 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery...

CVE-2026-18066

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by vulnerabilities that could allow a local attacker to obtain sensitive information and trigger unauthorized actions. This is caused by server-side request forgery . No specific exploit details or remediation steps are prov...

CVE-2026-95813

e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails urlfor in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query...

CVE-2026-76909

Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML...

CVE-2026-75101 Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...

CVE-2026-75101

An authorization bypass vulnerability exists in GitHub Enterprise Server (versions prior to 3.22) due to a repository name collision flaw. Access tokens for raw pull request diffs and patches were incorrectly scoped to the repository name and pull request number rather than a globally unique iden...

GHSA-4GHV-53CQ-7WP3 Home Assistant: mDNS Server-Side Request Forgery

Summary Home Assistant Green is vulnerable to a Server-Side Request Forgery SSRF via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal servic...

GHSA-JVH5-97XG-V99F Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses

Summary Cloudreve's server-side request forgery guard ValidateExternalURL pkg/request/ssrf.go resolves a user-supplied URL host and rejects it when any resolved IP is a loopback, private, link-local, multicast, unspecified, CGNAT, or the cloud-metadata address. The classification is performed by...

CVE-2026-62985

creationtimestamp| type| source ---|---|--- 2026-09-22 20:35:06+00:00| published-proof-of-concept| https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g...

CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2026-96260

The Mattermost server is vulnerable to a denial of service because it fails to enforce a request body size limit during CSRF validation of plugin requests. This flaw allows an authenticated user to exhaust server memory by sending a large request body to a plugin endpoint. Affected versions inclu...

CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2026-96259 Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the...

CVE-2026-96259

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x

CVE-2026-96259 Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the...

wlc may disclose API tokens to project-configured URLs

Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL,...