CVE-2026-109652 Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

CVE-2026-85970

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to improper XML external entity restriction. The software enables XML external entity processing by default in multiple server paths, which could allow an attacker to use crafted XML to trigger server-side...

CVE-2026-85970 Improper XML external entity restriction in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files...

CVE-2026-85970 Improper XML external entity restriction in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files...

CVE-2026-85960 Cross-site request forgery in Progress MarkLogic Server Query Console

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's...

EUVD-2026-97682

Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling linkpreviewconfig on /crawl requests. Attackers can supply a controlled page with includeexternal and includepatterns set, causing AsyncUrlSeeder to fet...

CVE-2026-109238

Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling linkpreviewconfig on /crawl requests. Attackers can supply a controlled page with includeexternal and includepatterns set, causing AsyncUrlSeeder to fet...

TanStack Router cross-site scripting vulnerability

The TanStack Router contains a cross-site scripting vulnerability. This vulnerability arises because unauthenticated attackers can inject non-public fields into the payload of server-side function requests. As a result, the state of the middleware is altered, and objects with incorrect response...

Siemens RUGGEDCOM CROSSBOW processing logic error vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a processing logic vulnerability. This vulnerability stems from the failure to properly execute server-side authorization checks for requests involving special operations. As a result, attackers with extremely low permissions may be able to...

Razorpay IFSC server-side request forgeing vulnerability

Razorpay IFSC 2.0.62 and earlier versions have a server-side request forgeing vulnerability. This vulnerability stems from server-side request forgeing, where attackers can submit specially crafted IFSC codes to IFSC.find or IFSC, along with network path references or absolute URIs. These URIs ar...

Shaarli Community: Shaarli Server Request Forgery Vulnerability

The Shaarli Community version 0.16.9 and earlier contain a server-side request forgeing vulnerability. This vulnerability stems from server-side request forgeing, where private addresses are not checked during the retrieval of bookmark thumbnails. Certified users can manipulate server requests to...

ProPhoenix Law Records Management Software security vulnerabilities

The ProPhoenix Law Records Management Software version v2022.2403.3.101 contains a security vulnerability stemming from server-side request forgery in the serviceURL parameter. This vulnerability may allow attackers to force the application server to initiate unintended DNS and web requests via...

Kubeflow Hub server request forgery vulnerability

Kubeflow Hub versions 0.3.17 and earlier have a server-side request forgeing vulnerability. This vulnerability stems from an issue with server-side request forgeing in the modelregistry.kubeflow.org/url annotation. It may allow namespace users to steal the controller ServiceAccount token. By...

CVE-2026-85955

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to improper privilege management in the xdmp:eval-in function. A remote attacker with query-execution access can invoke an XQuery evaluation function without the necessary evaluation privilege, potentially...

EUVD-2026-97517

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated...

CVE-2026-85951

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 deployed on Azure are vulnerable to a server-side request forgery (SSRF) (CWE-918). This vulnerability allows an authenticated attacker to access internal cloud services, which could lead to the unauthorized acquisition ...

CVE-2026-93693

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests t...

CVE-2026-108836

A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to t...

CVE-2026-93693

Progress ShareFile Storage Zones Controller versions v5.12.6 and below are vulnerable to a vulnerability chain involving improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on the queue service. A remote unauthenticate...

CVE-2026-108836 Ollama Pull API name.go IsValid server-side request forgery

A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to t...