CVE-2026-39932 OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

GHSA-JHPW-976M-542J Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering SSR so that they can be reused during client-side hydration. During SSR, HttpTransferCache previously generated identical key material for distinct request parameters when repeated values were present because...

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering SSR so that they can be reused during client-side hydration. During SSR, HttpTransferCache previously generated identical key material for distinct request parameters when repeated values were present because...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the HttpTransferCache used for server-side rendering, which builds the transfer-cache key by joining repeated HttpParams values with commas so that distinct parameter shapes produce the...

CVE-2026-68930 Russh: Channel-scoped server callbacks can be reached without an open channel

Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, serverreadauthenticated, and the execrequest callback. Version 0.62.5 fixes the issue...

CVE-2026-69078

CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...

CVE-2026-69078 Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering

CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...

CVE-2026-69078

CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...

CVE-2026-69078 Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering

CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...

CVE-2026-16250 Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...

CVE-2026-12872

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...

EUVD-2025-210596

The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other...

Apache CXF < 4.0.4 - Aegis DataBinding SSRF / Local File Read

Apache CXF before 4.0.4, 3.6.3 and 3.5.8 has a Server-Side Request Forgery SSRF vulnerability when using the Aegis DataBinding. The XOP Include mechanism in multipart SOAP requests can be abused to read local files or make server-side HTTP requests to arbitrary URLs. An attacker can use this to...

Exploit for CVE-2026-2020

--- CVE-2026-2020 – SSRF via URL Parser Differential...

PT-2026-67568

Server-side request forgery ssrf in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

PT-2026-67339

CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...

PT-2026-67548

Name of the Vulnerable Software and Affected Versions Adobe Campaign Classic ACC affected versions not specified Description Adobe Campaign Classic ACC contains a Server-Side Request Forgery SSRF flaw, which occurs when a server is tricked into making requests to an unintended location. This issu...

PT-2026-67499

Name of the Vulnerable Software and Affected Versions ip-address versions 10.1.1 through 10.2.1 Description Special-use classification methods in the library are built on the isInSubnet function, which returns false if the address's own subnet mask is shorter than the reference range's mask. By...

PT-2026-67503

Name of the Vulnerable Software and Affected Versions Shlink affected versions not specified Description Authenticated API key holders can trigger server-side request forgery SSRF, a flaw where the server is coerced into making unauthorized requests. By providing a crafted long URL during the sho...

ip-address: ip-address: Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IP addresses. By appending a Classless Inter-Domain Routing CIDR suffix to an IP address, an attacker can bypass the library's special-use classification methods. This misclassification can lead applications, such a...