Loading story…
Two server-side request forgery vulnerabilities were disclosed in widely deployed application servers, allowing attackers to use exposed systems to reach internal-only resources. Vikunja is affected by CVE-2026-33675, a medium-severity flaw with a CVSS v3.1 score of 6.4 that requires authentication but can let a user read data from services on the same internal network. Arcane is affected by CVE-2026-40242, a higher-severity issue scored 7.2 that requires no authentication and allows external attackers to send HTTP GET requests into internal network zones through the server’s template fetch mechanism.
The disclosures warn that both flaws can expose sensitive infrastructure that is normally unreachable from the internet, including cloud instance metadata endpoints, internal administrative interfaces, unauthenticated databases, Docker APIs, Redis services, and vulnerable microservices. In cloud environments, access to metadata services could reveal temporary IAM credentials, user-data scripts, and configuration variables that support lateral movement or privilege escalation. Arcane said the issue was patched in version 1.17.3 with tighter network boundaries, authentication checks, and sanitized error handling, while Vikunja’s flaw remains notable because it can undermine confidentiality even without directly enabling remote code execution.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A high-severity unauthenticated SSRF vulnerability in Arcane was publicly reported. The issue allows external attackers to relay HTTP GET requests into internal network zones, creating risk of internal service exposure and possible lateral movement.
Arcane addressed an unauthenticated SSRF vulnerability in version 1.17.3 by adding stricter network boundaries, explicit error sanitization, and authentication requirements. The flaw could let external attackers probe internal services such as Docker APIs, Redis, or cloud metadata endpoints.
A medium-severity server-side request forgery vulnerability affecting Vikunja task migration was disclosed. The flaw allows an authenticated attacker to access internal network resources reachable by the application server, with elevated risk in cloud environments due to possible metadata and credential exposure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two newly disclosed vulnerabilities expose sensitive information in widely used web application components. **CVE-2026-33182** affects **Saloon PHP** and allows unauthenticated, network-based **server-side request forgery (SSRF)** that can leak API credentials and session tokens, potentially granting attackers access to integrated third-party services and enabling misuse of those external environments. The issue carries a **CVSS 4.0 score of 6.6** and is described as a high-confidentiality-impact flaw, with the host application's local database remaining intact even as connected systems may be exposed. A separate issue, **CVE-2026-33501**, affects the **WWBN AVideo Permissions Plugin** and discloses an application's internal authorization model by revealing mappings between user groups and specific plugins. Although rated lower at **CVSS v3.1 5.3** and not associated with credential or personally identifiable information exposure, the flaw provides valuable reconnaissance that can help attackers identify privileged roles, map the attack surface, and support follow-on privilege escalation attempts against vulnerable authenticated extensions.
Jun 29, 2026
Microsoft published three high-severity cloud-service vulnerabilities affecting **Microsoft Purview eDiscovery**, **Microsoft Entra ID Entitlement Management**, and **Microsoft Dynamics 365 Online**. The flaws are tracked as `CVE-2026-26150`, `CVE-2026-35431`, and `CVE-2026-32210`, and all are classified as **server-side request forgery (SSRF)** under `CWE-918`. Microsoft tagged each issue as affecting an **exclusively hosted service**, indicating exposure in Microsoft-managed online environments rather than on-premises deployments. According to the CVE records, `CVE-2026-26150` could let an unauthorized attacker elevate privileges over a network in Purview eDiscovery, while `CVE-2026-35431` and `CVE-2026-32210` could enable spoofing in Entra ID Entitlement Management and Dynamics 365 Online. The published `CVSS v3.1` vectors show low attack complexity and no required privileges across all three issues, with Entra ID carrying the broadest potential impact to confidentiality, integrity, and availability, and Dynamics 365 requiring user interaction. Microsoft linked the disclosures to its Security Response Center guidance for customer tracking and remediation.
Jun 29, 2026
Critical vulnerabilities were disclosed in **Ivanti Cloud Services Application (CSA)** and **VMware vCenter Server** products, exposing enterprise management platforms to remote compromise. Ivanti said CSA `5.0.2` and earlier contain three flaws—`CVE-2024-11639`, `CVE-2024-11772`, and `CVE-2024-11773`—that can enable authentication bypass, remote code execution, and arbitrary SQL query execution through the administrator browser console, with the most severe issues rated **CVSS 10.0**. Ivanti released fixes in CSA `5.0.3` and urged customers to update immediately. VMware also disclosed two vulnerabilities affecting **vCenter Server** and **VMware Cloud Foundation**: `CVE-2024-38812`, a heap overflow that can allow arbitrary code execution, and `CVE-2024-38813`, which can enable privilege escalation to root. The flaws affect vCenter Server `7.0` and `8.0` as well as VMware Cloud Foundation `4.x` and `5.x`, and can be exploited remotely over the network using specially crafted packets. In both vendor notices, no active exploitation had been confirmed at the time of disclosure, but organizations and service providers were advised to apply vendor-fixed versions without delay because successful attacks could result in full administrative compromise.
Jun 29, 2026