CVE-2026-51681: Improper Access Control

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84031

Name of the Vulnerable Software and Affected Versions MapSVG versions prior to 8.15.1 Description An unauthenticated Server Side Request Forgery SSRF exists in the MapSVG plugin. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended locatio...

CVE-2026-51681

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83704

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

CVE-2026-51681

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83724

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw message...

CVE-2026-82659: External Control of File Name or Path

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw message...

The vulnerability of the Actor component in Google Chrome and Microsoft Edge web browsers allows a perpetrator to trigger a service failure.

The vulnerability of the Actor component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to cause service interruptions through a specially created HTML page...

PT-2026-84035

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 4.5.7 Smarty versions prior to 5.8.2 Description Smarty is a PHP template engine that separates presentation from application logic. A flaw exists in the fetch handling within libs/plugins/function.fetch.php and...

Important: apr-util

Issue Overview: APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or...

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge browsers allows a perpetrator to compromise data integrity.

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client-side. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...

The vulnerability of the Paint component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the Paint component in Google Chrome and Microsoft Edge is related to improper protection against attacks via external physical channels. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data through a specially created HTML page...

CVE-2026-82556

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...

CVE-2026-82556

Forgejo up to 15.0.4 is affected by a server-side request forgery (SSRF) vulnerability in the Repository Migration Handler . The root cause is the use of net.LookupIP in services/migrations/allowlist/is_migrate_allowed.go, where a remote attacker with low privileges can perform a manipulation to ...

CVE-2026-82556

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...

CVE-2026-82556 Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...

CVE-2026-82648

WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails to normalize NAT64 addresses written in hexadecimal form. Attackers can bypass SSRF protections by supplying hex-encoded NAT64 addresses like 64:ff9b::a9fe:a9fe to reach cloud...

EUVD-2026-68214

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

OESA-2026-3581 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attack...

OESA-2026-3567 openssh security update

An open source implementation of SSH protocol version 2 Security Fixes: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. This outcome occurs only on the client side.CVE-2026-60002...