CoverageArchiveRelease emailSecurity alertsStatus pagesNews digestMembership
Sign inGet the 07:40
ADVISORYHIGH6d ago · Sep 10, 2026

Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Applications using @angular/platform-server are exposed to high-severity SSRF and server-side credential disclosure.

A discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery (SSRF), potentially leaking sensitive server-side credentials. Technical Description When…

Read it at @angular/platform-server

More advisory

4 itemsEverything on the wire ›
ADVISORY
CRITICAL: esphome-device-builder — ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
The dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were…
esphome-device-builder
2d
ADVISORY
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
Mockoon's admin API (commons-server/src/libs/server/admin-api.ts) is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime (commons-server, CLI, serverless), serves…
@mockoon/commons-server
5d
ADVISORY
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 Upgrade mechanism. Since Traefik moved to unencrypted HTTP/2 with prior knowledge (Go 1.24), a client-initiated Upgrade: h2c request header and its…
github.com/traefik/traefik/v3
6d
ADVISORY
Traefik HTTP/3 Backend NTLM Connection Reuse
Traefik's HTTP/3 request path did not initialize the connection-scoped backend transport holder that isolates connection-bound NTLM and Negotiate (Kerberos) authentication on the HTTP/1.1 and HTTP/2 paths. The HTTP/3 entrypoint reuses the HTTPS…
github.com/traefik/traefik/v3
6d