Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the router process. An attacker can retrieve sensitive information from internal network resources by crafting requests that leverage specific file suffixes and HTTP 302 redirects to bypass...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the router process. An attacker can retrieve sensitive information from internal network resources by crafting requests that leverage specific file suffixes and HTTP 302 redirects to bypass...

PT-2026-21942

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.2.2 Description A Server-Side Request Forgery SSRF flaw exists in the "Add Link" feature of Plane, allowing an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network...

Docker Desktop Code Execution

The vulnerability of the Docker Desktop platform’s configuration for developing and delivering container applications is related to the improper assignment of permissions to critical resources. Exploiting this vulnerability can allow attackers to enhance their privileges and execute arbitrary cod...

Linux fs/ext4/namei.c Heap Buffer Overflow DoS

The vulnerability of the dxprobe function in the fs/ext4/namei.c module of the Linux file system support module is related to the distribution of resources without any restrictions or regulation. Exploiting this vulnerability could allow a hacker to cause service failures...

lpfc_abort_handler Heap Buffer Overflow DoS

Vulnerability of the lpfcaborthandler function in the drivers/scsi/lpfc/lpfcscsi.c module – The Linux SCSI device driver has synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

OpenEMR security vulnerabilities

OpenEMR is a set of open-source medical management systems developed by the OpenEMR community. This system can be used for medical practice management, electronic medical records, prescription writing, and medical billing applications. Versions of OpenEMR prior to 8.0.0 contained security...

NFS Client Heap Buffer Overflow DoS

The vulnerability of the nfs4openandgetstate function in the fs/nfs/nfs4proc.c module, which is part of the NFS client support in Linux kernel, is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-28886

Уязвимость системы непрерывной интеграции и доставки приложений CI/CD JetBrains TeamCity связана с неполной очисткой временных или вспомогательных ресурсов. Эксплуатация уязвимости может позволить нарушителю получить несанкционированный доступ к защищаемой информации...

PT-2026-21933

Name of the Vulnerable Software and Affected Versions esm.sh versions prior to 137 Description esm.sh is susceptible to a full-response Server-Side Request Forgery SSRF issue. This allows an attacker to retrieve information from internal websites. The issue resides in the routing logic,...

Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads

Impact A Server-Side Request Forgery SSRF vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network resources. Users are affected ...

CVE-2026-27732

WWBN AVideo is an open source video platform. Prior to version 22.0, the aVideoEncoder.json.php API endpoint accepts a downloadURL parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests ...

CVE-2026-27732 AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

WWBN AVideo is an open source video platform. Prior to version 22.0, the aVideoEncoder.json.php API endpoint accepts a downloadURL parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests ...

CVE-2026-27567 Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads

Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery SSRF vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an...

CVE-2026-27567

Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery SSRF vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an...

CVE-2026-27567 Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads

Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery SSRF vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an...

CVE-2026-25638 ImageMagick has memory leak in msl encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in coders/msl.c. In the WriteMSLImage function of the msl.c file, resources are allocated. But the function returns early without releasing...

GNU C Library getnetbyaddr RCE

The vulnerability of the getnetbyaddr and getnetbyaddrr functions in the GNU C Library is related to the use of uninitialized resources. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to protected information...

CVE-2026-25985: Allocation of Resources Without Limits or Throttling

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate 674 GB of memory, leading to an out-of-memory abort. Versions...

Mozilla Firefox and Mozilla Thunderbird resource management error vulnerabilities

Mozilla Firefox and Mozilla Thunderbird are both products of the American Mozilla Foundation. Mozilla Firefox is an open-source web browser. Mozilla Thunderbird is an email client software that emerged independently from the Mozilla Application Suite. This software supports IMAP and POP email...