PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

Summary The domain whitelist introduced in PhpSpreadsheet 5.4.0 for the WEBSERVICE formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but filegetcontents follows 302/301 redirects by default without re-validating the redirect target agains...

CVE-2026-61949

creationtimestamp| type| source ---|---|--- 2026-07-23 13:06:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcvpn7bac2s...

CVE-2026-59526

creationtimestamp| type| source ---|---|--- 2026-07-23 13:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcvevrzyn2e 2026-08-12 22:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msw5rlakev2c...

CVE-2026-59514

creationtimestamp| type| source ---|---|--- 2026-07-23 12:58:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcvbd3cpb2u...

CVE-2026-64142

creationtimestamp| type| source ---|---|--- 2026-07-23 12:00:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcrzkrruz2k 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20261002...

CVE-2026-64132

creationtimestamp| type| source ---|---|--- 2026-07-23 11:56:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcrsftlaf23 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20261002...

CVE-2026-60834

creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrraokts2b 2026-07-23 17:47:49+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-60159

creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j 2026-07-23 16:47:04+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-60158

creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j...

CVE-2026-47043

creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j...

CVE-2026-47062

creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j...

CVE-2026-47055

creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j...

CVE-2026-47053

creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j...

meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch

Server-Side Request Forgery SSRF in uploadadimage via Unrestricted imageurl Fetch SummaryThe uploadadimage MCP tool in meta-ads-mcp v1.0.113 passes an attacker-controlled imageurl parameter directly to an HTTP fetch helper httpx.AsyncClientfollowredirects=True.geturl without any scheme, host, or ...

PraisonAI: SpiderTools redirect-target SSRF protection bypass

SpiderTools redirect-target SSRF protection bypass SummarySpiderTools.scrapepage validates the initial URL and rejects directloopback, private, link-local, metadata, and internal hostnames. It then callsrequests.Session.get without disabling automatic redirects or validatingredirect Location...

PYSEC-2026-3531 PraisonAI: SpiderTools redirect-target SSRF protection bypass

SpiderTools redirect-target SSRF protection bypass Summary SpiderTools.scrapepage validates the initial URL and rejects direct loopback, private, link-local, metadata, and internal hostnames. It then calls requests.Session.get without disabling automatic redirects or validating redirect Location...

CVE-2026-62145

creationtimestamp| type| source ---|---|--- 2026-07-23 11:36:19+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116969083939726073 2026-07-23 12:00:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcs2aeery2b 2026-07-29 08:40:30+00:00| seen|...

CVE-2026-64799

Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...

Server-Side Request Forgery

Spring Boot Admin Server is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-supplied healthUrl and managementUrl parameters during instance registration, allowing unauthenticated attackers to force the server to send HTTP requests to...

CVE-2026-7120 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent...