CVE-2026-54204 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathnameroot' parameter in search functionality

Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled...

CVE-2026-54204

CVE-2026-54204 affects Tobit Laboratories AG TeamDavid’s Webbox. The search function accepts a pathnameroot parameter that can be set to UNC network locations; the server processes these values without validation, causing outbound connections to attacker-controlled SMB endpoints. This enables una...

CVE-2026-16027

Server-Side request forgery SSRF vulnerability in Revenue Administration Türkiye's E-Signature allows Server Side Request Forgery. This issue affects Türkiye's E-Signature: from 2.4.4.0 before 2.5.1.0...

EUVD-2026-54397

Server-Side request forgery SSRF vulnerability in Revenue Administration Türkiye's E-Signature allows Server Side Request Forgery. This issue affects Türkiye's E-Signature: from 2.4.4.0 before 2.5.1.0...

CVE-2026-16027

CVE-2026-16027 : An unauthenticated SSRF exists in Türkiye’s E-Signature (from 2.4.4.0 up to before 2.5.1.0). The issue allows server-side requests initiated by the service, with CVSS v3.1 base score 5.4 (Network attack vector, Low complexity, No privileges, User interaction required; Confidentia...

CVE-2026-16027

Server-Side request forgery SSRF vulnerability in Revenue Administration Türkiye's E-Signature allows Server Side Request Forgery. This issue affects Türkiye's E-Signature: from 2.4.4.0 before 2.5.1.0...

EUVD-2026-54327

Server-side request forgery ssrf in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network...

EUVD-2026-54279

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

EUVD-2026-54248

A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...

EUVD-2026-54192

The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders...

EUVD-2026-54245

A Server-Side Request Forgery SSFR vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses...

CVE-2026-70332

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network...

PT-2026-69088

Name of the Vulnerable Software and Affected Versions Datadog Android application versions prior to 545-5.9.2 Description Six App Widget configuration activities—IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and...

CVE-2026-70332

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-48081

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN can store javascript: URLs in the tenant links configuration website, imprint, privacyStatement. These values are returned to the patient-facing landin...

CVE-2026-19127

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal LTD redemption codes, an unauthenticated attacker...

CVE-2026-15734

A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...

CVE-2026-15732

A Server-Side Request Forgery SSFR vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses...

CVE-2026-14831

The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders...

Cross-site Scripting (XSS)

Overview pdfjs-dist is a Portable Document Format PDF library that is built with HTML5. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the enableScripting configuration when loading a crafted PDF file. An attacker can execute arbitrary JavaScript code in the...