CVE-2026-90790

A server-side request forgery (SSRF) vulnerability exists in a2aproject a2a-python (versions up to 1.1.3 ). The flaw is in the function _dispatch_notification within the Push Notification Sender component (src/a2a/server/tasks/base_push_notification_sender.py), where an attacker can manipulate th...

CVE-2026-90790 a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

EUVD-2026-77515

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...

Astra Linux – Vulnerability in Batik

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...

Astra Linux – Vulnerability in Batik

A Server-Side Request Forgery SSRF vulnerability exists in Batik of Apache XML Graphics, allowing an attacker to load a URL through the jar protocol. This issue affects Apache XML Graphics Batik 1.14...

Astra Linux – Vulnerability in Python 2.7, Python 3.7

The urllib.parse.urlsplit and urlparse functions improperly validate bracketed hosts , allowing hosts that are neither IPv6 nor IPvFuture. This behavior does not conform to RFC 3986 and could potentially enable SSRF if a URL is processed by more than one URL parser...

Astra Linux – Vulnerability in xmlgraphics-commons

Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users...

Astra Linux – Vulnerability in Batik

A Server-Side Request Forgery SSRF vulnerability exists in the Batik of Apache XML Graphics, allowing attackers to access files using a Jar URL. This issue affects Apache XML Graphics Batik 1.14...

Astra Linux – Vulnerability in Axis

UNSUPPORTED WHEN ASSIGNED When integrating Apache Axis 1.x in an application, it might not have been obvious that using “ServiceFactory.getService” could lead to potentially dangerous operations, such as LDAP queries. Passing untrusted input to this API method could expose the application to DoS,...

Astra Linux – Vulnerability in Batik

A Server-Side Request Forgery SSRF vulnerability exists in the Batik of Apache XML Graphics, allowing attackers to retrieve external resources. This issue affects Apache XML Graphics Batik version 1.14...

Astra Linux – Vulnerability in python-reportlab

All versions of the reportlab package are vulnerable to Server-side Request Forgery SSRF via img tags. To reduce this risk, use trustedSchemes and trustedHosts see Reportlab’s documentation. Steps to reproduce by Karan Bamal: 1. Download and install the latest version of the reportlab package. 2...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.65 and earlier, with Server Side Includes SSI enabled and modcgid but not modcgi, pass the shell-escaped query string to the exec cmd="..." directives. This issue affects Apache HTTP Server versions prior to 2.4.66. Users are recommended to upgrade to version 2.4.66, which...

Astra Linux – Vulnerability in Batik

A server-side request forgery SSRF vulnerability exists in Apache Software Foundation Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik version 1.16. In version 1.16, a malicious SVG file may trigger the loading of external resources by default, leading to resource consumpti...

Astra Linux – Vulnerability in Apache2

A potential vulnerability in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly set up URLs to be handled by modproxy. Users are recommended to upgrade to version 2.4.60, which fixes this issue...

Astra Linux – Vulnerability in Jetty9

Eclipse Jetty is a lightweight, highly scalable Java-based web server and Servlet engine. It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class performs insufficient validation on the authority segment of a URI. However, the behavior of HttpURI differs from that of common...

Astra Linux – Vulnerability in xmltooling

Shibboleth XMLTooling before version 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allowed SSRF through a specially crafted KeyInfo element. This issue has been fixed, for example, in Shibboleth Service Provider 3.4.1.3 on Windows...

Astra Linux – Vulnerability in Batik

Server-side Request Forgery SSRF vulnerability in Apache Software Foundation Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik version 1.16. A malicious SVG can probe user profile/data and send it directly as a parameter to a URL...

CVE-2026-90710

CVE-2026-90710 is a Server-Side Request Forgery (SSRF) vulnerability in taisan tarzan-cms version 1.0.0 . The flaw resides in the openConnection function within the Theme Download Function component, specifically in the file com/tarzan/cms/modules/admin/service/biz/ThemeService.java. By manipulat...

Security Bulletin: IBM MQ is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-11714)

Summary A server-side request forgery vulnerability was identified in IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality Vulnerability Details CVEID:CVE-2026-11714 DESCRIPTION: IBM WebSphere Application Server Liberty i...

WebGoat v2026.3

WebGoat: A deliberately insecure Web Application Introduction WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. This program is a demonstration of common server-side application flaws. The exercises are intended to be used b...