CVE-2026-59765

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Aug 13, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-597664.3Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated wiCVE-2026-597699.1FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel's internal network, CVE-2026-59779.8A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setWiFiBasicCfg of the file /cgi-bin/csteCVE-2026-597749.8Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to serverCVE-2026-597767.0Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is explCVE-2026-59789.8A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setWiFiAclRules of the file /cCVE-2026-597807.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDACVE-2026-597817.8When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directoryCVE-2026-597826.9The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap daCVE-2026-597832.3The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loCVE-2026-597855.1Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read accesCVE-2026-597866.9Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means
CVE-2026-59765: High severity, CVSS 7.5 | Vulnix