Grokability Snipe-IT side-channel information leakage vulnerability

Versions of Grokability Snipe-IT prior to 8.7.0 contain a side-channel information disclosure vulnerability. This vulnerability stems from server-side request forgery within the webhook testing functionality, enabling super administrators to discover internal network addresses including loopback...

NoMachine server request forgery vulnerability

NoMachine 9.8.21 version has a vulnerability related to server-side request forgeing. This vulnerability arises from the web service failing to correctly validate URIs before accessing resources. As a result, unauthorized remote attackers can initiate arbitrary server-side requests under the...

GHSA-62VG-58RM-QFF7 @angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. During route recognition, @angular/router fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name...

@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. During route recognition, @angular/router fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name...

@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

An open redirect vulnerability was identified in @angular/platform-server when Server-Side Rendering SSR is enabled. When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by ServerPlatformLocation using resolveUrl or parseUrl in v20. While resolveUrl...

GHSA-W739-GVWX-GRC3 @angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

An open redirect vulnerability was identified in @angular/platform-server when Server-Side Rendering SSR is enabled. When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by ServerPlatformLocation using resolveUrl or parseUrl in v20. While resolveUrl...

Server-Side Request Forgery

Apache Camel is vulnerable to Server-Side Request Forgery. The vulnerability is due to the AS2 component taking the MDN destination address from the inbound message without validation, where it uses that address as the destination for the outgoing receipt and a remote partner can supply an...

TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-032...

SUSE CVE-2026-73560

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformersutils/processors/mimov2omni.py passes attacker-controlled image and audio strings through fetchimage, requests.get, and Image.open instead of MediaConnector,...

CLEANSTART-2026-SE68013 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...

EUVD-2026-104637

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function getimgfromurl of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument imgurl/imageurl can lead to server-side...

PT-2026-120339

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8 and RouterLink directives are rendered with queryParamsHandling: 'merge' or 'preserve', configured either per link or globally via defaultQueryParamsHandling. Starting i...

This Week in Spring - October 20th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's almost Halloween! What're you going dressed as, if you celebrate? I'm going dressed as PHP code. Terrifying! We've got a ton of stuff to dive into this week, so let's get right into it. a nice article by Craig Walls call...

PT-2026-118577

An open redirect vulnerability was identified in @angular/platform-server when Server-Side Rendering SSR is enabled. When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by ServerPlatformLocation using resolveUrl or parseUrl in v20. While resolveUrl...

PT-2026-120297

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8 and RouterLink directives are rendered with queryParamsHandling: 'merge' or 'preserve', configured either per link or globally via defaultQueryParamsHandling. Starting i...

Apache jclouds 2.7.0 XML External Entity Injection

Apache jclouds version 2.7.0 contains an XML External Entity injection vulnerability in provider-response parsing that may allow local file disclosure or server-side request forgery when a parsed endpoint is attacker controlled. !/usr/bin/env bash Apache jclouds 2.7.0 XML External Entity XXE...

PT-2026-118576

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. During route recognition, @angular/router fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name...

CVE-2026-112358

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function getimgfromurl of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument imgurl/imageurl can lead to server-side...

CVE-2026-112358

A Server-Side Request Forgery (SSRF) vulnerability exists in TiBillet Lespass (up to version 10e87909c5d526dffa6d424c104fc12860740537). The flaw is located in the get_img_from_url function within the ApiBillet/serializers.py file of the APIv1 component. By manipulating the img_url or image_url ar...

CVE-2026-112358 TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgery

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function getimgfromurl of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument imgurl/imageurl can lead to server-side...