CVE-2026-40465

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

CVE-2026-40465

Nokia NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter. This vulnerability allows an attacker to potentially redirect users to an untrusted site. Exploitation details, specific affected versions, and remediation steps are not prov...

CVE-2026-40465 An Open Re-direct Vulnerability in Nokia NSP

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

CVE-2026-40465 An Open Re-direct Vulnerability in Nokia NSP

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping

A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting XSS. An...

PT-2026-84038

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 5.0.0 Description Authenticated users can store an arbitrary SMTP host, including private and cloud-metadata IP addresses, in their personal email notification settings due to a lack of server-side SSRF Server-Side...

PT-2026-83716

A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the component Transport Endpoint. The manipulatio...

CVE-2026-58301

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...

C-MOR 6.0104 Cross Site Scripting

C-MOR Video Surveillance versions 6.0104 and below suffer from a cross site scripting vulnerability. Exploit Title: C-MOR 6.0104 - Cross-Site Scripting XSS Google Dork: N/A Date: 2026-07-23 Exploit Author: Samir Shamdin Alb Cyber Guards Vendor Homepage: https://www.c-mor.com Software Link:...

CVE-2026-79747: Server-Side Request Forgery (SSRF)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, an authenticated non-admin user can register a server pointing at an arbitrary URL and make the hub issue...

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge web browsers allows a perpetrator to compromise data integrity.

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client-side. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

PT-2026-84053

Name of the Vulnerable Software and Affected Versions hyperledger-firefly versions prior to 1.4.1 Description A server-side request forgery SSRF exists within the Webhook Subscription component. This occurs when the url argument is manipulated in the ValidateOptions function located in the...

PT-2026-84031

Name of the Vulnerable Software and Affected Versions MapSVG versions prior to 8.15.1 Description An unauthenticated Server Side Request Forgery SSRF exists in the MapSVG plugin. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended locatio...

PT-2026-84035

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 4.5.7 Smarty versions prior to 5.8.2 Description Smarty is a PHP template engine that separates presentation from application logic. A flaw exists in the fetch handling within libs/plugins/function.fetch.php and...

Important: apr-util

Issue Overview: APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or...

PT-2026-83724

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw message...

CVE-2026-82659: External Control of File Name or Path

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw message...

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge web browsers allows a perpetrator to compromise data integrity.

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client-side. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...

Linux Distros Unpatched Vulnerability : CVE-2026-77310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1,...