CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-85179

Label Studio versions through 1.23.0 are affected by a Server-Side Request Forgery (SSRF) vulnerability in the webhook functionality (specifically in webhooks/utils.py). The application fails to validate webhook URLs , allowing authenticated users to dispatch outbound requests to internal network...

EUVD-2026-70483

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-85163

AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epglink parameter during video upload, which is validated only for syntax and...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.33.3.SP1 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

CVE-2026-85106 NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launch...

EUVD-2026-70413

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launch...

CVE-2026-85172 n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present,...

CVE-2026-85164 WWBN AVideo Server-Side Request Forgery via set_api_userImages

WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the setapiuserImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal...

CVE-2026-85163 AVideo Server-Side Request Forgery via epg_link parameter

AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epglink parameter during video upload, which is validated only for syntax and...

EUVD-2026-70372

Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory...

Security update for apr-util

This update for apr-util fixes the following issues: CVE-2022-25147: buffer overflow possible with specially crafted input bsc1207866. CVE-2025-49506: leaking content via side channel timing attack bsc1274237. CVE-2026-32327: XML stack recursion crash bsc1274235. CVE-2026-34191: SQL Injection via...

SUSE-SU-2026:3938-1 Security update for apr-util

This update for apr-util fixes the following issues: - CVE-2022-25147: buffer overflow possible with specially crafted input bsc1207866. - CVE-2025-49506: leaking content via side channel timing attack bsc1274237. - CVE-2026-32327: XML stack recursion crash bsc1274235. - CVE-2026-34191: SQL...

Security update for apr-util

This update for apr-util fixes the following issues: CVE-2022-25147: buffer overflow possible with specially crafted input bsc1207866. CVE-2025-49506: leaking content via side channel timing attack bsc1274237. CVE-2026-32327: XML stack recursion crash bsc1274235. CVE-2026-34191: SQL Injection via...

PT-2026-84976

Name of the Vulnerable Software and Affected Versions OCS Inventory affected versions not specified Description An authenticated user with operator privileges can exploit a Server-Side Request Forgery SSRF issue. This occurs due to insufficient validation of the HTTPS SERV and FILE SERV parameter...

Practice Makes (Im)Perfect: A Look Back at Benchmarking Practices for Microarchitectural Side-Channel Attacks

Microarchitectural side-channel research has grown at an exceptional pace in recent years, increasing the need for rigorous and meaningful benchmarking. Early attack papers typically relied on indirect proxies, such as covert-channel bandwidth or key-recovery on naive AES and RSA implementations,...

The vulnerability of the pingback.ping method in the WordPress content management system allows a hacker to perform an SSRF attack.

The vulnerability of the pingback.ping method in the WordPress content management system is related to synchronization errors when using a shared resource “Race Situation”. This occurs due to improper validation of requests on the server side. Exploiting this vulnerability allows an attacker to...

PT-2026-85074

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the...

CVE-2026-78593: Improper Control of Generation of Code

An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...