CVE-2026-50112 Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates

SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal...

CVE-2026-61422

An authenticated Server-Side Request Forgery (SSRF) vulnerability exists in Apache CloudStack versions 4.20.3.0 and 4.21.0.0 through 4.22.1.0 . The flaw resides in the template and ISO registration functionality , where the system performs a live HTTP HEAD/GET call to determine file size for seco...

EUVD-2026-63836

Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validatio...

CVE-2026-61422

Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validatio...

CVE-2026-61422 Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate

Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validatio...

CVE-2026-61422 Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate

Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validatio...

SUSE CVE-2026-73623

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

SUSE CVE-2026-76218

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the...

PT-2026-79352

Name of the Vulnerable Software and Affected Versions misp-stix affected versions not specified Description A path traversal issue exists in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. The system constructs a filesystem path by joining the configured...

CVE-2026-61422: Server-Side Request Forgery (SSRF)

Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validatio...

Linux Distros Unpatched Vulnerability : CVE-2026-77506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS. CVE-2026-77506 Note that Nessus relies on the presence of the package as reported by the...

PT-2026-80280

Summary The Volt template compiler in Phalcon generates the PHP for the join filter by string-concatenating the filter's raw template-literal argument bytes with no escaping. The separator literal is dropped verbatim between two single quotes the compiler emits, and the piped array argument is...

PT-2026-79327

Name of the Vulnerable Software and Affected Versions Apache CloudStack version 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description An authenticated Server-Side Request Forgery SSRF exists in the template and ISO registration functionality. When registering a template or ISO...

PT-2026-79424

Name of the Vulnerable Software and Affected Versions Infracost versions prior to 0.10.45 Description Template functions readFile, pathExists, isDir, and matchPaths in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that fail to resolve...

CVE-2026-49436

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint POST /api/v2/bulk/links accepts URLs without any format validation, allowing an authenticated user to store a javascript: URI. The stored URI is later rendered verbatim as an href in Blad...

CVE-2026-49436 LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint POST /api/v2/bulk/links accepts URLs without any format validation, allowing an authenticated user to store a javascript: URI. The stored URI is later rendered verbatim as an href in Blad...

DEBIAN-CVE-2026-77506

Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS...

CVE-2026-77506

Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS...

CVE-2026-77506

Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS...

CVE-2026-77506

Znuny before LTS 6.5.22 is affected by a template XSS vulnerability in the AgentTicketEmailResend component. An attacker with high privileges and requiring user interaction can inject malicious content through the template, leading to low-impact cross-origin confidentiality and integrity compromi...