CVE-2026-93759

A flaw was found in Mongoid where it fails to properly neutralize string-typed query criteria. This vulnerability allows an unauthenticated attacker to inject server-side JavaScript expressions into database queries. Successful exploitation can lead to the unintended disclosure of sensitive store...

CVE-2026-73599

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site 'Open Redirect' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...

CVE-2026-73599

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site 'Open Redirect' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...

CVE-2026-73599

Dell Secure Connect Gateway (SCG) Policy Manager , versions prior to 5.34.00.16 , is vulnerable to an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker with remote access could exploit this flaw, potentially leading to Server-side request forgery . Rem...

EUVD-2026-88755

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site 'Open Redirect' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...

Server-Side Request Forgery

Apache Shiro is vulnerable to Server-Side Request Forgery. The vulnerability is due to insufficient validation of the form‑resubmit target in the Jakarta EE integration module, where the server will initiate an outbound connection to a URL supplied in a crafted HTTP request and transmit...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to multiple vulnerabilities in fast-uri.

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to multiple vulnerabilities in fast-uri. CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parse...

CVE-2026-102244

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

CVE-2026-102244 MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

EUVD-2026-88618

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

CVE-2026-102244

MODSetter SurfSense versions up to 0.0.36 are vulnerable to a server-side request forgery (SSRF) flaw within the Document Export Feature . The vulnerability exists in an unspecified function located in surfsense_backend/app/routes/editor_routes.py. This flaw allows for remote manipulation that ca...

CVE-2026-102244 MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

CVE-2026-102244 MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

PT-2026-102895

ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the download file and scrape web agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata...

CVE-2026-77177

Open GenAI Stack aka ogx-ai 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection with Jinja2 template syntax can be used to achieve server-side expression evaluation without sanitization...

EUVD-2026-89070

Open GenAI Stack aka ogx-ai 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection with Jinja2 template syntax can be used to achieve server-side expression evaluation without sanitization...

CVE-2026-77177

Open GenAI Stack aka ogx-ai 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection with Jinja2 template syntax can be used to achieve server-side expression evaluation without sanitization...

AEM Forms Server-Side Validation Exploitation

The vulnerability of the corporate platform for creating, managing, and processing Adobe Experience Manager AEM Forms on JEE is related to insufficient testing of server-side requests. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

CVE-2026-73599: URL Redirection to Untrusted Site

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site 'Open Redirect' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...

Infinite loop

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Infinite loop via the afterdoctypenamestate handler in Domino's HTML parser lib/HTMLParser.js, used by @angular/platform-server for server-side rendering. Whe...