CVE-2026-90790 a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

CVE-2026-90790

A server-side request forgery (SSRF) vulnerability exists in a2aproject a2a-python (versions up to 1.1.3 ). The flaw is in the function _dispatch_notification within the Push Notification Sender component (src/a2a/server/tasks/base_push_notification_sender.py), where an attacker can manipulate th...

EUVD-2026-77515

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.65 and earlier, with Server Side Includes SSI enabled and modcgid but not modcgi, pass the shell-escaped query string to the exec cmd="..." directives. This issue affects Apache HTTP Server versions prior to 2.4.66. Users are recommended to upgrade to version 2.4.66, which...

Astra Linux – Vulnerability in Batik

A Server-Side Request Forgery SSRF vulnerability exists in Batik of Apache XML Graphics, allowing an attacker to load a URL through the jar protocol. This issue affects Apache XML Graphics Batik 1.14...

Astra Linux – Vulnerability in Batik

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...

Astra Linux – Vulnerability in Batik

A Server-Side Request Forgery SSRF vulnerability exists in the Batik of Apache XML Graphics, allowing attackers to retrieve external resources. This issue affects Apache XML Graphics Batik version 1.14...

Astra Linux – Vulnerability in Batik

A server-side request forgery SSRF vulnerability exists in Apache Software Foundation Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik version 1.16. In version 1.16, a malicious SVG file may trigger the loading of external resources by default, leading to resource consumpti...

Astra Linux – Vulnerability in xmlgraphics-commons

Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users...

Astra Linux – Vulnerability in Python 2.7, Python 3.7

The urllib.parse.urlsplit and urlparse functions improperly validate bracketed hosts , allowing hosts that are neither IPv6 nor IPvFuture. This behavior does not conform to RFC 3986 and could potentially enable SSRF if a URL is processed by more than one URL parser...

Astra Linux – Vulnerability in xmltooling

Shibboleth XMLTooling before version 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allowed SSRF through a specially crafted KeyInfo element. This issue has been fixed, for example, in Shibboleth Service Provider 3.4.1.3 on Windows...

Astra Linux – Vulnerability in Jetty9

Eclipse Jetty is a lightweight, highly scalable Java-based web server and Servlet engine. It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class performs insufficient validation on the authority segment of a URI. However, the behavior of HttpURI differs from that of common...

Astra Linux – Vulnerability in Batik

Server-side Request Forgery SSRF vulnerability in Apache Software Foundation Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik version 1.16. A malicious SVG can probe user profile/data and send it directly as a parameter to a URL...

CVE-2026-90710

CVE-2026-90710 is a Server-Side Request Forgery (SSRF) vulnerability in taisan tarzan-cms version 1.0.0 . The flaw resides in the openConnection function within the Theme Download Function component, specifically in the file com/tarzan/cms/modules/admin/service/biz/ThemeService.java. By manipulat...

Security Bulletin: IBM MQ is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-11714)

Summary A server-side request forgery vulnerability was identified in IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality Vulnerability Details CVEID:CVE-2026-11714 DESCRIPTION: IBM WebSphere Application Server Liberty i...

WebGoat v2026.3

WebGoat: A deliberately insecure Web Application Introduction WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. This program is a demonstration of common server-side application flaws. The exercises are intended to be used b...

CVE-2026-71198

CVE-2026-71198 is a server-side request forgery (SSRF) in OpenStack Glance before 32.0.1 . When the HTTP store backend is enabled, the location API validates only the URL scheme but does not apply import_filtering_opts host restrictions. An authenticated user can add an image location pointing to...

PT-2026-91294

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images...

PT-2026-91710

A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in...

PT-2026-91395

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit...