CVE-2026-5490 DriveLock SQL Injection Privilege Escalation Vulnerability

DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-5489 DriveLock Directory Traversal Information Disclosure Vulnerability

DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service,...

Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network

Summary Caldav::connecttoserver at application/controllers/Caldav.php:60 hands the request's caldavurl to a Guzzle REPORT call without scheme or host validation. A logged-in backend user admin, provider, or secretary reaches loopback, RFC1918, and link-local hosts on the deployment's network. The...

CVE-2026-54735

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafte...

prebid-server's request forgery vulnerability allows for possible host environment data extraction

Impact Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop through the customRandom function in the customRandom implementation. An attacker can hang the calling thread by supplying a size of 0 to customRandom, which causes its ID generation loop to never reach a terminating...

nanoid: non-secure generators can loop indefinitely with negative size

nanoid Nano ID before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module nanoid/non-secure. When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning...

GHSA-2V37-7H3G-55P8 nanoid: custom generators can loop indefinitely when size is zero

nanoid Nano ID before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that...

CVE-2026-64273

A flaw was found in the Linux kernel's iforce input driver. A malicious actor with a specially crafted input device could exploit an out-of-bounds write vulnerability by sending an unvalidated force-feedback effect index. This could allow the attacker to corrupt memory, potentially leading to...

OPeNDAP Hyrax is vulnerable to SSRF and Credential Disclosure

Overview A vulnerability has been discovered in the OPeNDAP Hyrax software solution. A remote attacker with the ability to submit crafted requests to an affected Hyrax instance could cause the application to communicate with unauthorized remote systems. Under certain conditions, the vulnerability...

📄 rouille 3.6.2 HTTP Response Splitting

rouille versions 3.6.2 and earlier contain an HTTP response splitting vulnerability due to improper validation of response header values. Applications that place attacker-controlled data into HTTP response headers can inject carriage return and line feed characters, allowing attackers to create...

PT-2026-65831

Name of the Vulnerable Software and Affected Versions Prebid Server versions prior to 4.4.0 Description Certain bidder adapters interpolate user-supplied parameters into outbound request URLs without proper validation of host and subdomain values. This allows a malicious actor to craft bid reques...

Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2026-54659

Pagy (Ruby gem) contains a vulnerability in the I18n locale handling prior to 43.5.6: Pagy::I18n.locale= stores locale values verbatim and later uses them as .yml path components, enabling untrusted params[:locale] values with absolute paths or ../ sequences to probe file existence/readability of...

EUVD-2026-50069

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...

CVE-2026-51267

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

EUVD-2026-49879

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...

CVE-2026-43910 Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...

java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

Summary When directConnecttrue is enabled, appium/java-client unconditionally accepts directConnectHost, directConnectPort, and directConnectPath from the server's NEWSESSION response and silently redirects all subsequent session traffic to the attacker-specified endpoint — with no allowlist, no...

CVE-2026-67173 Pivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requests

Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...