EUVD-2026-110821

NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure and data tampering...

CVE-2026-24269

The NVIDIA TensorRT-LLM software is susceptible to a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). A successful exploit could lead to information disclosure and data tampering . No specific technical root cause, affected versions, or remediation steps are provided in the documentati...

CVE-2026-116826

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/tag/duplicate, storing local...

CVE-2026-116605

A vulnerability exists in the SourceCodester Online Food Ordering System 1.0 within an unknown function of the order.php file. The root cause is client-side enforcement of server-side security (CWE-602), where manipulating the price/title arguments allows for unauthorized actions. This vulnerabil...

CVE-2026-116605 SourceCodester Online Food Ordering System order.php client-side enforcement of server-side security

A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file order.php. The manipulation of the argument price/title results in client-side enforcement of server-side security. It is possible to launch the attack remotely. Th...

PT-2026-126405

NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure...

PT-2026-126424

Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a page key to an internal URL, which GetTitleByURL fetches after...

Server-side expression parser denial of service

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression uncontrolled recursion. A user with permission to provision alert rules can make the outage persist across restarts. Thanks to Mukul Goyal for reporting this vulnerability to us...

PT-2026-126402

NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure and data tampering...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : nginx vulnerabilities (USN-8955-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8955-1 advisory. It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite...

CVE-2026-116826

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/tag/duplicate, storing local...

SUSE CVE-2026-116192

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to...

USN-8955-1: nginx vulnerabilities

It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-15176 It was discovered tha...

CVE-2026-115189

A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates the fix for GHSA-9fx4-7cmj-47vg does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. A...

CVE-2026-116280 Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery

A vulnerability was determined in Kameleo up to 5.0.1.26. Affected is the function InternalController.TestProxy of the file client-engine-application/f.cs of the component Proxy Validation. Executing a manipulation of the argument host/port can lead to server-side request forgery. The attack may ...

CVE-2026-116280 Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery

A vulnerability was determined in Kameleo up to 5.0.1.26. Affected is the function InternalController.TestProxy of the file client-engine-application/f.cs of the component Proxy Validation. Executing a manipulation of the argument host/port can lead to server-side request forgery. The attack may ...

CVE-2026-116280

A Server-Side Request Forgery (SSRF) vulnerability exists in Kameleo up to version 5.0.1.26 . The flaw is located in the Proxy Validation component, specifically within the InternalController.TestProxy function of the client-engine-application/f.cs file. An attacker can remotely launch an attack ...

CVE-2026-116280 Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery

A vulnerability was determined in Kameleo up to 5.0.1.26. Affected is the function InternalController.TestProxy of the file client-engine-application/f.cs of the component Proxy Validation. Executing a manipulation of the argument host/port can lead to server-side request forgery. The attack may ...

EUVD-2026-109792

A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates the fix for GHSA-9fx4-7cmj-47vg does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. A...

CVE-2026-115189

A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates the fix for GHSA-9fx4-7cmj-47vg does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. A...