28096 matches found
EUVD-2026-58198
Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...
CVE-2026-58314
Two SSRF findings in Gitea 1.26.2...
CVE-2026-58314 Two SSRF findings in Gitea 1.26.2
Two SSRF findings in Gitea 1.26.2...
CVE-2026-58314
CVE-2026-58314 _ Two SSRF findings in Gitea 1.26.2. The NVD entry reports two SSRF vulnerabilities in Gitea 1.26.2 with CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N and a base score of 7.7 (HIGH). The connected sources also reference public advisories and a later release addressi...
org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation
A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...
org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation
A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...
CVE-2026-66704
Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...
CVE-2025-62315
HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions...
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...
EUVD-2026-57907
Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...
EUVD-2026-57893
Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...
EUVD-2025-210725
HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions...
CVE-2025-62315 HCL AION is affected by multiple security vulnerabilities.
HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions...
CVE-2025-62315
Technical details of CVE-2025-62315 are not publicly available in the provided documents; monitor for updates.
DEBIAN-CVE-2026-73627
JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...
CVE-2026-73627
JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...
CVE-2026-59504
CWE-602: Client-Side Enforcement of Server-Side Security...
CVE-2026-59504
CWE-602: Client-Side Enforcement of Server-Side Security...