12845 matches found
Server-Side Request Forgery (SSRF)
Spring Cloud Function is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled file or resource paths, allowing an attacker to read arbitrary local files or make requests to attacker-controlled or internal resources...
CVE-2026-86498: Incorrect Authorization
In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission...
CVE-2025-52657: Allocation of Resources Without Limits or Throttling
HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability...
PT-2026-86851
In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR...
CVE-2026-82753: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to exhaust database storage and memory. The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolveclient...
PT-2026-86870
In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission...
SUSE CVE-2026-65835
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the...
AZL-99684 CVE-2026-80888 affecting package kernel for versions less than 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dmabuf reference on foreign-fd prime import ttmprimefdtohandle returns -ENOSYS when the imported fd's dmabuf-ops do not match the ttmobjectdevice's ops, but does so without releasing the reference acquired by...
EUVD-2026-71638
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dmabuf reference on foreign-fd prime import ttmprimefdtohandle returns -ENOSYS when the imported fd's dmabuf-ops do not match the ttmobjectdevice's ops, but does so without releasing the reference acquired by...
CVE-2026-85675
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...
CVE-2026-85675 OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...
CVE-2026-85675 OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...
CVE-2026-78682
A flaw was found in NLTK. When an HTTP proxy is configured, a server-side request forgery SSRF vulnerability exists in the nltk.pathsec.urlopen function. An attacker can exploit this by providing a seemingly valid public URL, which the proxy then forwards to an internal service without proper...
CVE-2026-85703: Allocation of Resources Without Limits or Throttling
A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server/backend.py of the component Jailbreak Mode. Executing a manipulation can lead to allocation of resources. The attack can be...
The vulnerability of the bpf_iter_unix_seq_show() function in the net/unix/af_unix.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the bpfiterunixseqshow function in the net/unix/afunix.c module of the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility ...
CVE-2026-85675: Server-Side Request Forgery (SSRF)
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...
CVE-2026-80888: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dmabuf reference on foreign-fd prime import ttmprimefdtohandle returns -ENOSYS when the imported fd's dmabuf-ops do not match the ttmobjectdevice's ops, but does so without releasing the reference acquired by...
PT-2026-91801
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dma buf reference on foreign-fd prime import ttm prime fd to handle returns -ENOSYS when the imported fd's dma buf-ops do not match the ttm object device's ops, but does so without releasing the reference acquire...
PT-2026-91353
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in free rd atomic resources free rd atomic resources iterates using qp-attr.max dest rd atomic. Updating max dest rd atomic before freeing the old array can make the free path walk past the old allocation and...
