linux-apache-fix-mod_rewrite-spaceInURL

FIX linux Ubuntu Apache modrewrite space In URL After the last Apache Upgrade, I've had some issues with "spaces in URL" in modrewrite. 2023-04-25 - upgrade apache2:amd64 2.4.38-3+deb10u9 2.4.38-3+deb10u10 The URLs that contain "space" and have been replaced with %20 start to return error 403 by...

CVE-2026-100104

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

CVE-2026-89117

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

EUVD-2026-98197

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-89117 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-89117

SAP NetWeaver Enterprise Portal is vulnerable to a Cross-Site Scripting (XSS) flaw (CWE-79). An unauthenticated attacker can inject malicious scripts into a URL parameter , which are reflected in the server response and executed in a victim's browser upon visiting a crafted URL. This can lead to ...

PT-2026-111142

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal affected versions not specified Description An unauthenticated attacker can inject malicious scripts into a URL parameter. These scripts are reflected in the server response and executed in the browser of a user...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : lxml vulnerabilities (USN-8897-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8897-1 advisory. Guillem Lefait discovered that lxml incorrectly handled certain URL attributes. A...

PT-2026-111157

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.3 through 19.2.7 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1 Description An authenticated user can perform server-side request forgery SSRF, which allows the attacker to reach...

CVE-2026-107369: URL Redirection to Untrusted Site

The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative...

CVE-2026-104587

The blob42 gosuki application (through commit 6e2bf34 ) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the use of text/template instead of html/template, which leads to a failure in performing context-aware auto-escaping on the URL and DisplayURL fields with...

CVE-2026-83646: URL Redirection to Untrusted Site

Url redirection to untrusted site 'open redirect' in Active Directory Federation Services AD FS allows an authorized attacker to perform spoofing over a network...

CVE-2026-110220: Server-Side Request Forgery (SSRF)

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

CVE-2026-110255: Server-Side Request Forgery (SSRF)

Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or clou...

PT-2026-111844

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

CVE-2026-104587: Improper Neutralization of Input During Web Page Generation

blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting XSS vulnerability. The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields of bookmarks in internal/webui/templates/bookmarks.html. An...

CVE-2026-103576: URL Redirection to Untrusted Site

Url redirection to untrusted site 'open redirect' in Active Directory Federation Services AD FS allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-83500: URL Redirection to Untrusted Site

Url redirection to untrusted site 'open redirect' in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack...

CVE-2026-75061

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to write arbitrary files on the system...

CVE-2026-75061

IBM Planning Analytics versions 2.0 and 2.1 are vulnerable to a path traversal flaw. A remote attacker can exploit this by sending a specially crafted URL request containing "dot dot" sequences (/../) to bypass directory restrictions. This allows the attacker to write arbitrary files on the syste...