Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Summary The ACME client used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs connects to an acmeurl, then issues requests to URLs that the ACME server returns in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF RFC 8555...

CVE-2026-31378 Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution

Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue...