PT-2026-64964

Contributor Server Side Request Forgery SSRF in Feedzy = 5.2.4 versions...

PT-2026-65314

Name of the Vulnerable Software and Affected Versions Simple Link Directory Pro versions prior to 15.0.7 Description An unauthenticated Server Side Request Forgery SSRF exists in the plugin. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an...

Linux Distros Unpatched Vulnerability : CVE-2026-13066

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being...

CVE-2026-17458 mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack...

CVE-2026-17458

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack...

CVE-2026-17458 mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack...

CVE-2026-17458 mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack...

Path Traversal

dompdf/dompdf is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths when processing SVG images embedded through data: URIs, where the second SVG processing pass performed by php-svg-lib does not enforce the same security restrictions, allowing an...

PT-2026-64809

Name of the Vulnerable Software and Affected Versions openclaw-cn versions prior to 0.2.2 Description An issue exists in the Browser Control HTTP API component within the clickViaPlaywright function located in the src/browser/routes/agent.act.ts file. A remote attacker can perform a manipulation...

CVE-2026-17458: Server-Side Request Forgery (SSRF)

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack...

Server-Side Request Forgery (SSRF)

phpoffice/phpspreadsheet is vulnerable to Server-Side Request Forgery SSRF.The vulnerability is due to improper validation of redirected URLs in the WEBSERVICE formula function, where only the initial URL is checked against the domain whitelist while HTTP redirects are followed without...

MGASA-2026-0300 Updated wget packages fix security vulnerabilities

Updated wget packages fix security vulnerabilities: -CVE-2026-58469 Wget incorrectly handled Metalink documents containing a whitespace-only URL. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Mageia 9 and Mageia 10. -CVE-2026-58470 : Wget...

Server-Side Request Forgery (SSRF)

org.apache.camel, camel-dns is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of DNS-related Exchange message headers dns.server, dns.name, dns.domain, etc. that can be passed from inbound HTTP requests, which allows an attacker to manipulate DNS...

Server-Side Request Forgery

Next.js is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of Host-associated headers during Server Action forwards and redirects, allowing attackers to redirect outbound requests to malicious or internal hosts and potentially expose sensitive...

Cache Confusion

Next.js is vulnerable to Cache Confusion. The vulnerability is due to improper caching of server-side fetch responses, where cached response bodies may be reused across requests with different request bodies, allowing confidential data from one request to be exposed to unauthorized users...

Sensitive Information Exposure

Next.js is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper caching of server-side fetch responses for non-UTF-8 request bodies, where different request bodies can share the same cache entry, allowing confidential response data to be exposed to unauthorized...

Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field

Security Advisory: Camaleon CMS - Authenticated RCE via selec...

FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller

Summary The OpenAPI adapter's spec-change poller OpenApiSpecPoller re-fetched the configured spec url on a timer using a raw global fetch, bypassing the SSRF guard safeFetch / assertUrlSafe that OpenAPIToolGenerator.fromURL applies to the initial spec load. As a result, the pinning/DNS-resolution...

OmniFaces: Forged combined-resource IDs and related output/push boundaries

Forged combined-resource IDs CombinedResourceInfo accepts a path-derived ID without an authenticity check, inflates it without an output limit, converts it to attacker-selected resource identifiers, and retains unique IDs in an unbounded static cache. In bounded tests, 20,754 encoded bytes...

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

Summary Cloudreve exposes two admin node test endpoints under the Admin.Read OAuth scope. These endpoints accept attacker-controlled node definitions and cause Cloudreve to make outbound server-side network requests. This allows an OAuth client authorized only for Admin.Read to trigger operationa...