PT-2026-120339

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8 and RouterLink directives are rendered with queryParamsHandling: 'merge' or 'preserve', configured either per link or globally via defaultQueryParamsHandling. Starting i...

PT-2026-120297

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8 and RouterLink directives are rendered with queryParamsHandling: 'merge' or 'preserve', configured either per link or globally via defaultQueryParamsHandling. Starting i...

PT-2026-118577

An open redirect vulnerability was identified in @angular/platform-server when Server-Side Rendering SSR is enabled. When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by ServerPlatformLocation using resolveUrl or parseUrl in v20. While resolveUrl...

Apache jclouds 2.7.0 XML External Entity Injection

Apache jclouds version 2.7.0 contains an XML External Entity injection vulnerability in provider-response parsing that may allow local file disclosure or server-side request forgery when a parsed endpoint is attacker controlled. !/usr/bin/env bash Apache jclouds 2.7.0 XML External Entity XXE...

PT-2026-118576

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. During route recognition, @angular/router fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name...

CVE-2026-112358

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function getimgfromurl of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument imgurl/imageurl can lead to server-side...

CVE-2026-112358

A Server-Side Request Forgery (SSRF) vulnerability exists in TiBillet Lespass (up to version 10e87909c5d526dffa6d424c104fc12860740537). The flaw is located in the get_img_from_url function within the ApiBillet/serializers.py file of the APIv1 component. By manipulating the img_url or image_url ar...

CVE-2026-112358 TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgery

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function getimgfromurl of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument imgurl/imageurl can lead to server-side...

CVE-2026-112358 TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgery

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function getimgfromurl of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument imgurl/imageurl can lead to server-side...

CVE-2026-112299 smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery

A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side...

CVE-2026-112299

A server-side request forgery (SSRF) vulnerability exists in the smrealms smr product within the Album Website component. The flaw is located in the isUrlReachable function of the file src/pages/Account/AlbumEditProcessor.php, where manipulating the Website argument allows for remote exploitation...

CVE-2026-112299 smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery

A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side...

CVE-2026-112299 smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery

A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side...

CVE-2026-112297 ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery

A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...

CVE-2026-112297

A server-side request forgery (SSRF) vulnerability exists in ptbsare anx-calibre-manager versions up to 1.13.12 . The flaw is located within the LLM Configuration Handler component, specifically in the LLMClient.chat function of the file blueprints/api/llm.py. An attacker can remotely initiate th...

CVE-2026-112297 ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery

A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...

CVE-2026-112254 agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery

A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function fetchhtml of the file locations/services/propertyurlimporter.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The...

CVE-2026-112254

A server-side request forgery (SSRF) vulnerability exists in agit8or1 clientst0r up to version 3.17.586 . The flaw is located in the _fetch_html function within the Property URL Importer component (file: locations/services/property_url_importer.py). By manipulating the url argument, an attacker c...

CVE-2026-112254 agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery

A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function fetchhtml of the file locations/services/propertyurlimporter.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The...

CVE-2026-112254 agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery

A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function fetchhtml of the file locations/services/propertyurlimporter.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The...