@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8 and RouterLink directives are rendered with queryParamsHandling: 'merge' or 'preserve', configured either per link or globally via defaultQueryParamsHandling. Starting i...

GHSA-57XQ-RJX2-V5XH @angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8 and RouterLink directives are rendered with queryParamsHandling: 'merge' or 'preserve', configured either per link or globally via defaultQueryParamsHandling. Starting i...

CVE-2026-113671

ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local...

EUVD-2026-105220

ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local...

SvelteKit server-side request forgery vulnerability

Versions of SvelteKit prior to 3.0.0 contain a server-side request forgery vulnerability. This vulnerability arises from self-fetch fallback behavior that automatically follows HTTP redirects. Attackers can manipulate the Host or forwarded headers to redirect the fallback requests to their own...

Chris Trudesk input validation error vulnerability

Versions 1.2.11 and earlier of Chris Trudesk contain an input validation error vulnerability. This vulnerability stems from server-side JavaScript injection in the search parameter; authenticated users can inject code into MongoDB’s $where clause. By disabling regular expressions in GET...

HarnessRouter server request forgery vulnerability

HarnessRouter versions 0.31.12 and earlier contain a server-side request forgery vulnerability. This vulnerability stems from improper handling of the baseurl parameter by an unknown function within the gateway/app.py file in the Targets Test Endpoint component, potentially enabling remote...

Grokability Snipe-IT side-channel information leakage vulnerability

Versions of Grokability Snipe-IT prior to 8.7.0 contain a side-channel information disclosure vulnerability. This vulnerability stems from server-side request forgery within the webhook testing functionality, enabling super administrators to discover internal network addresses including loopback...

NoMachine server request forgery vulnerability

NoMachine 9.8.21 version has a vulnerability related to server-side request forgeing. This vulnerability arises from the web service failing to correctly validate URIs before accessing resources. As a result, unauthorized remote attackers can initiate arbitrary server-side requests under the...

Data Intelligence Lab@HKU Vibe-Trading prompt injection vulnerability

In Data Intelligence Lab@HKU Vibe-Trading versions 0.1.0 through 0.1.7, there is a prompt injection vulnerability. This occurs because the agent injects commands into documents or web pages; BashTool and BackgroundRunTool pass the commands generated by the model directly to subprocess.run execute...

@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. During route recognition, @angular/router fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name...

GHSA-62VG-58RM-QFF7 @angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. During route recognition, @angular/router fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name...

GHSA-W739-GVWX-GRC3 @angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

An open redirect vulnerability was identified in @angular/platform-server when Server-Side Rendering SSR is enabled. When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by ServerPlatformLocation using resolveUrl or parseUrl in v20. While resolveUrl...

@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

An open redirect vulnerability was identified in @angular/platform-server when Server-Side Rendering SSR is enabled. When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by ServerPlatformLocation using resolveUrl or parseUrl in v20. While resolveUrl...

Server-Side Request Forgery

Apache Camel is vulnerable to Server-Side Request Forgery. The vulnerability is due to the AS2 component taking the MDN destination address from the inbound message without validation, where it uses that address as the destination for the outgoing receipt and a remote partner can supply an...

TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-032...

SUSE CVE-2026-73560

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformersutils/processors/mimov2omni.py passes attacker-controlled image and audio strings through fetchimage, requests.get, and Image.open instead of MediaConnector,...

CLEANSTART-2026-SE68013 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...

EUVD-2026-104637

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function getimgfromurl of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument imgurl/imageurl can lead to server-side...

This Week in Spring - October 20th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's almost Halloween! What're you going dressed as, if you celebrate? I'm going dressed as PHP code. Terrifying! We've got a ton of stuff to dive into this week, so let's get right into it. a nice article by Craig Walls call...