CVE-2026-111323: Server-Side Request Forgery (SSRF)

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validateurl checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata...

HPE NonStop RDMA SERVICES NSK buffer error vulnerability

HPE NonStop RDMA SERVICES NSK T0941L03^ABS and earlier versions contain a buffer error vulnerability. This vulnerability stems from a buffer overflow, which may lead to out-of-bounds memory writes and result in memory corruption...

PT-2026-114965

A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash...

PT-2026-115284

JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using...

PT-2026-114968

A buffer overflow vulnerability in HPE NonStop RDMA SERVICES NSK may cause out-of-bounds memory write, which may result in memory corruption...

CVE-2026-111171: Server-Side Request Forgery (SSRF)

Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because checkipblocked does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA record...

CVE-2026-79838: Stack-based Buffer Overflow

A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash...

CVE-2026-79841: Out-of-bounds Write

A buffer overflow vulnerability in HPE NonStop RDMA SERVICES NSK may cause out-of-bounds memory write, which may result in memory corruption...

CVE-2026-105032: Unrestricted Upload of File with Dangerous Type

The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper...

CVE-2026-0311 Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability

A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services...

CVE-2026-0311

A Server-Side Request Forgery (SSRF) vulnerability exists in Palo Alto Networks Checkov by Prisma® Cloud . This flaw allows a local unauthenticated user to trigger unauthorized network requests from the host to internal services. As a workaround , users should avoid running Checkov over untrusted...

CVE-2026-0311 Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability

A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services...

CVE-2026-55385

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...

CVE-2026-55385

The InvoiceShelf web and mobile application is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 2.4.0 . The root cause lies in PDFConfigurationRequest.php, which only performs syntactic validation on the owner-controlled gotenberg_host setting. Consequently, GotenbergPDFDrive...

CVE-2026-55385 InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...

EUVD-2026-101612

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...

CVE-2026-55385 InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...

CVE-2026-55385 InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...

CVE-2026-15102

ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Jackson Databind

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Jackson Databind. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-83557 DESCRIPTION: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied...