CVE-2026-55374 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55374

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55374 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55374 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-11926 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

EUVD-2026-78893

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-11926

The IBM Verify Identity Access software is vulnerable to a denial of service (DoS) attack. This is caused by insufficient validation of incoming request resources , which could allow a remote attacker to trigger uncontrolled resource consumption. While the vulnerability is confirmed, the provided...

CVE-2026-11926 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-11927

The IBM Security Verify Identity Access reverse proxy is vulnerable to a flaw where parameters can be injected into requests sent to third-party services. This issue is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') . Th...

EUVD-2026-78892

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-54549

meta-ads-mcp (a Model Context Protocol server for Meta Ads) contains a Server-Side Request Forgery (SSRF) in the upload_ad_image tool. Prior to v1.0.115 , an attacker-controlled image_url parameter is passed to httpx.AsyncClient with follow_redirects=True and no scheme, host, or IP validation , e...

CVE-2026-12101

The IBM Verify Identity Access and IBM Security Verify Access products are affected by CVE-2026-12101. The vulnerability allows an administrator to execute additional commands they are not entitled to due to the improper validation of user-supplied requests . This issue could result in unauthoriz...

EUVD-2026-78884

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests...

EUVD-2026-78876

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-12358 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-12358 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-12358

IBM Verify Identity Access and IBM Security Verify Access are vulnerable to a denial of service (DoS) attack due to uncontrolled recursion (CWE-674) caused by insufficient validation of incoming request resources. Affected versions include IBM Verify Identity Access 11.0.0 - 11.0.3 IF1, IBM Secur...

CVE-2026-81897

In Concrete CMS below CMS 9.5.3, the savecontrol action in the Express entities forms dashboard controller did not validate the anti-CSRF token. By causing an authenticated administrator to submit a forged cross-site request, a remote attacker without credentials could write attacker-controlled...

DEBIAN-CVE-2024-14029

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling...

AZL-103101 CVE-2024-14029 affecting package python-tornado 6.3.3-11

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling...