Skip to content
Threat Feed
Subscribe

Tag

Internal-Reconnaissance

2 briefs RSS
critical advisory

SQL Injection in UTMStack via UtmAssetGroupService

UTMStack versions prior to 11.2.16 are vulnerable to an authenticated SQL injection in the UtmAssetGroupService, allowing attackers to execute arbitrary commands with DBA privileges.

UTMStack sql-injection vulnerability web-application remote-code-execution cve-2026-82041 ssrf internal-reconnaissance
2r 5t 1c
high advisory

Gitea Server-Side Request Forgery Vulnerabilities

Two Server-Side Request Forgery (SSRF) vulnerabilities in Gitea version 1.26.2 and earlier allow authenticated users to bypass IP filtering for webhooks and repository migrations by targeting CGNAT and IPv6 transition prefixes, and unauthenticated users to trigger arbitrary GET requests against internal hosts via the OpenID sign-in form, potentially leading to internal network discovery and data exposure.

Gitea <= 1.26.2 ssrf gitea web-vulnerability internal-reconnaissance
1r 3t 1i