CVE-2026-85650

Trigger.dev versions before 4.5.2 contain a server-side request forgery (SSRF) vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal servi...

CVE-2026-85650 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

CVE-2026-18198

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TAC Information Services Internal and External Trade Inc. GOLDENHORN ONEIT allows Blind SQL Injection. This issue affects GOLDENHORN ONEIT: before Göbeklitepe...

CVE-2026-85614

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue request...

EUVD-2026-71082

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TAC Information Services Internal and External Trade Inc. GOLDENHORN ONEIT allows Blind SQL Injection. This issue affects GOLDENHORN ONEIT: before Göbeklitepe...

io.github.zoom-dustin-moriarty:zoom-data-fence (1.0.0), net.snowflake:snowflake-ingest-sdk (>=3.1.2-beta.unshaded, <=4.4.2-unshaded) +7 more potentially affected by CVE-2026-85525 via net.snowflake:snowflake-jdbc-thin (>=3.22.0, <=4.3.2)

net.snowflake:snowflake-jdbc-thin MAVEN version =3.22.0, =3.1.2-beta.unshaded, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =1.0.0, =3.4.0 Source cves: CVE-2026-85525 Source advisory: MEND:CVE-2026-85525...

Malicious code in cocha-logger-services (npm)

The package cocha-logger-services was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in ckeditor5-cloud-services (npm)

--- Credit: OpenSSF source...

Malicious code in chibi-store-services (npm)

--- Credit: OpenSSF source...

Malicious code in changed-services (npm)

The package changed-services was found to contain malicious code. --- Credit: OpenSSF source...

Horde javascript.php Backdoor RCE (CVE-2012-0209)

Exploits CVE-2012-0209 by passing shell commands through the href Cookie to /services/javascript.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Horde javascript.php backdoor RCE CVE-2012-0209 — execute session.""" from future import annotations import re...

PT-2026-85555

Marqo 2.26.0 contains a server-side request forgery vulnerability in the add documents endpoint that allows unauthenticated attackers to trigger requests to arbitrary URLs by supplying malicious media field values. Attackers can exploit download image from url and fetch content sample functions...

PT-2026-85541

Douyin TikTok Download API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video data endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services includi...

PT-2026-85514

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TAC Information Services Internal and External Trade Inc. GOLDENHORN ONEIT allows Blind SQL Injection. This issue affects GOLDENHORN ONEIT: before Göbeklitepe...

PT-2026-85672

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.2 Description A URL parser discrepancy allows a remote authenticated attacker to obtain sensitive information from internal services. This issue occurs because a backslash can be used to bypass...

CVE-2026-85686: Server-Side Request Forgery (SSRF)

ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...

PT-2026-85551

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.2 Description Authenticated users with organization membership can exploit a server-side request forgery SSRF issue. This occurs because webhook alert channel delivery URLs are fetched without proper validatio...

CVE-2026-85650: Server-Side Request Forgery (SSRF)

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

@fumapress/ai (>=0.2.3, <=0.2.5), @fumapress/feedback (>=0.2.4, <=0.2.5) +4 more potentially affected by CVE-2026-49456 via waku (>=0.19.4, <=1.0.0-beta.0)

waku NPM version =0.19.4, =0.2.3, =0.2.4, =1.0.0, =0.1.0, =0.2.5 - sakuin 0.1.0-alpha.1 - sladocs 0.1.0 Source cves: CVE-2026-49456 Source advisory: MEND:CVE-2026-49456...

@fumapress/ai (>=0.2.3, <=0.2.5), @fumapress/feedback (>=0.2.4, <=0.2.5) +4 more potentially affected by CVE-2026-49455 via waku (>=0.19.4, <=1.0.0-beta.0)

waku NPM version =0.19.4, =0.2.3, =0.2.4, =1.0.0, =0.1.0, =0.2.5 - sakuin 0.1.0-alpha.1 - sladocs 0.1.0 Source cves: CVE-2026-49455 Source advisory: MEND:CVE-2026-49455...