CVE Notifier

CVE-2026-92570 CWE-862 6.5

reNgine through 2.2.0 Unauthorized Configuration File Read

reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool configuration files. Attackers with low-privilege Aud…

cve.org yogeshojha:rengine 16 Sep 2026

CVE-2026-77404 CWE-116 N/A

RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into an AMQPS query string instead of encoding them as URL q…

cve.org rabbitmq:amqp091-go 16 Sep 2026

CVE-2026-92569 CWE-918 4.3

Hippo4j through 1.5.0 SSRF via clientAddress Parameter

Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames …

cve.org opengoofy:hippo4j 16 Sep 2026

CVE-2026-92568 CWE-918 5.4

MLRun through 1.11.0 Server-Side Request Forgery via Webhook

MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows authenticated users to make the API server send arbitrary HTTP requests to internal addresses. Atta…

cve.org mlrun:mlrun 16 Sep 2026

CVE-2026-92567 CWE-639 6.5

TDuck survey form through 5.0 Unauthorized Data Modification

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers c…

cve.org TDuckCloud:tduck-survey-form 16 Sep 2026

CVE-2026-92566 CWE-918 8.2

DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview

DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled …

cve.org datageartech:datagear 16 Sep 2026

CVE-2026-92565 CWE-359 5.3

Rallly before 4.15.0 Information Disclosure via polls.get

Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll…

cve.org lukevella:rallly 16 Sep 2026

CVE-2026-77410 CWE-789 N/A

RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the message body slice with the uint64 ch.header.Size value supplied by an AMQP content header without cappin…

cve.org rabbitmq:amqp091-go 16 Sep 2026

CVE-2026-92616 CWE-613 6.8

FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance

FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and write access by exploiting improper session isolation between t…

cve.org error311:FileRise 16 Sep 2026

CVE-2026-77406 CWE-195 N/A

RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos meth…

cve.org rabbitmq:amqp091-go 16 Sep 2026

CVE-2026-77403 CWE-770 N/A

RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation…

cve.org rabbitmq:amqp091-go 16 Sep 2026

CVE-2026-92395 CWE-290 9.1

@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written …

cve.org @fastify/proxy-addr:@fastify/proxy-addr 16 Sep 2026