CVE-2025-61163

The Cohere North AI v1.1.5 software is susceptible to an excessively permissive cross-domain policy because the server fails to properly validate the Origin header of incoming connection requests. This flaw allows untrusted domains to bypass security restrictions, potentially enabling an attacker...

Security Bulletin: Vulnerability in Requests affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Requests has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

CVE-2026-24170

NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests. A successful exploit of this vulnerability might lead to code execution and escalation of...

CVE-2026-24170

NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component that allows an attacker on an adjacent network to send specially crafted HTTP requests, leading to improper authentication . A successful exploit may result in code execution and privilege escalation , wit...

EUVD-2026-65608

NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests. A successful exploit of this vulnerability might lead to code execution and escalation of...

CVE-2026-24170

NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests. A successful exploit of this vulnerability might lead to code execution and escalation of...

BIT-KEYCLOAK-2024-4629 Keycloak: potential bypass of brute force protection

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. Thi...

CVE-2026-79659 Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata...

CVE-2026-56092

The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages...

CVE-2026-56092

The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages...

JetBrains TeamCity < 2021.1.1 (CVE-2021-37545)

The version of JetBrains TeamCity installed on the remote host is prior to 2021.1.1. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made. CVE-2021-37545 Note that Nessus has not tested for this iss...

PT-2026-81383

NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests. A successful exploit of this vulnerability might lead to code execution and escalation of...

PT-2026-81492

Name of the Vulnerable Software and Affected Versions Chainlit versions 2.4.0rc0 through 2.11.x Description Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the 'POST /mcp' endpoint without authentication. The ConnectSseMCPRequest and...

CVE-2026-77384

@libp2p/circuit-relay-v2 (part of the js-libp2p JavaScript networking stack) is vulnerable to a remote denial of service in its reservation refresh path within reservation-store.ts. Prior to version 4.2.9 , each refresh reuses the same retimeableSignal but unconditionally registers an additional ...

CVE-2026-49452

A flaw was found in WeasyPrint, a tool designed to create PDF documents from web content. When processing untrusted HTML with presentational hints enabled, WeasyPrint embeds unescaped HTML attribute values directly into CSS declarations. This vulnerability allows a remote attacker to inject...

Security Bulletin: Langflow OSS is affected by server-side request forgery in provider validation and API request functionality

Summary Langflow OSS includes outbound network request functionality for provider validation and API request execution. Weaknesses in request destination validation and enforcement could allow authenticated users to induce requests to unintended internal or external network locations, which may...

UBUNTU-CVE-2026-10582

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

CVE-2026-59295

It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service DoS condition due to an unbounded memory leak. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16 Micrometer 1.9.18 and earlier...

CLSA-2026-1787551818 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.25.1.post2+tuxcare...

.NET: .NET Core: .NET Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...