CVE-2026-86018 Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment...

CVE-2026-86018

The Part-DB inventory management system for electronic components is vulnerable to disk exhaustion in versions prior to 2.13.2 . The root cause is the "Download external file" attachment feature, which allows authenticated users to bypass the MAX_ATTACHMENT_FILE_SIZE limit. When server-side attac...

CLEANSTART-2026-AR72893 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

Security vulnerability affects the argo-cd package. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

PT-2026-121940

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, ::, NAT64 or localhost alias hostnames to read loopback, internal o...

PT-2026-122111

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — includin...

PT-2026-122083

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

PT-2026-122189

Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal network destinations via a crafted model URL. Multi Model Server is end of life and no fixed version is available. Users shoul...

PT-2026-121830

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed...

PT-2026-122084

Name of the Vulnerable Software and Affected Versions Signal K Server versions 2.28.0-beta.2 through 2.33.x Description An issue exists in the App Store icon fetcher that trusts absolute signalk.appIcon URLs, leading to server-side request forgery SSRF. This occurs when attackers publish npm...

Plex Media Server 1.43.3.10828 Timeline Server-Side Request Forgery

Plex Media Server versions before 1.43.3.10861 contain a server-side request forgery vulnerability via the /player/timeline endpoint. The supplied proof of concept demonstrates server-originated requests using an invalid X-Plex-Token value. https://packetstorm.news/download/237300...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the requirerequestheader process. An attacker can cause the Agent and Proxy services to shut down by sending requests to /agent/v1/quit or /proxy/v1/quit endpoints without the required header via server-side...

CVE-2026-115364 OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When requirerequestheader is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down the...

CVE-2026-104068

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craf...

npm: Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

npm: Nuxt: Server-side route rules redirect, headers, proxy, ssr are skipped for case-variant paths when routing is case-insensitive vulnerability discovered by ? in WordPress npm nuxt versions = 3.0.0, 4.0.0...

EUVD-2026-108228

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craf...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to the hono module (CVE-2026-84363, CVE-2026-84364, CVE-2026-84365 & CVE-2026-93981)

Summary IBM App Connect Enterprise Runtime is vulnerable to multiple vulnerabilities due to the hono module. Vulnerability Details CVEID:CVE-2026-93981 DESCRIPTION: hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of...

CVE-2026-113582

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...

EUVD-2026-108166

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...

CVE-2026-113582

This vulnerability affects all versions of Apache Abdera due to improper restriction of XML external entity references during Atom document parsing. An attacker could potentially access sensitive data or trigger server-side requests by providing attacker-controlled XML. Because Apache Abdera is r...

CVE-2026-113582

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...