CVE-2026-111171: Server-Side Request Forgery (SSRF)

Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because checkipblocked does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA record...

CVE-2026-79838: Stack-based Buffer Overflow

A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash...

CVE-2026-111330: Use of Password Hash With Insufficient Computational Effort

JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using...

CVE-2026-111323: Server-Side Request Forgery (SSRF)

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validateurl checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata...

PT-2026-114998

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy html escape form data to the encoded string, and then uses base64 decode to decode the value directly into the GPS...

PT-2026-114968

A buffer overflow vulnerability in HPE NonStop RDMA SERVICES NSK may cause out-of-bounds memory write, which may result in memory corruption...

PT-2026-115281

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate url checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadat...

Remote Desktop Services RCE

The vulnerability of Remote Desktop Services RDS for Windows operating systems relates to the use of memory after release. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2026-79841: Out-of-bounds Write

A buffer overflow vulnerability in HPE NonStop RDMA SERVICES NSK may cause out-of-bounds memory write, which may result in memory corruption...

CVE-2026-0311

A Server-Side Request Forgery (SSRF) vulnerability exists in Palo Alto Networks Checkov by Prisma® Cloud . This flaw allows a local unauthenticated user to trigger unauthorized network requests from the host to internal services. As a workaround , users should avoid running Checkov over untrusted...

CVE-2026-0311 Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability

A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services...

CVE-2026-0311 Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability

A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services...

CVE-2026-55385

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...

CVE-2026-55385 InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...

CVE-2026-55385

The InvoiceShelf web and mobile application is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 2.4.0 . The root cause lies in PDFConfigurationRequest.php, which only performs syntactic validation on the owner-controlled gotenberg_host setting. Consequently, GotenbergPDFDrive...

EUVD-2026-101612

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...

CVE-2026-55385 InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...

CVE-2026-55385 InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...

CVE-2026-15102

ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Jackson Databind

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Jackson Databind. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-83557 DESCRIPTION: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied...