Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
8 vulnerabilities by prebid
CVE-2026-54734 (GCVE-0-2026-54734)
Vulnerability from nvd – Published: 2026-09-17 21:59 – Updated: 2026-09-18 20:03
VLAI
EPSS
VEX
Title
Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction
Summary
Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can cause the server to send HTTP requests to unintended destinations, potentially reaching internal network services, metadata endpoints, or other sensitive server endpoints with the server's network access. This issue is fixed in version 3.43.0.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:03 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/prebid/prebid-server-java/secu… | x_refsource_CONFIRM |
| https://github.com/prebid/prebid-server-java/pull/4522 | x_refsource_MISC |
| https://github.com/prebid/prebid-server-java/comm… | x_refsource_MISC |
| https://github.com/prebid/prebid-server-java/comm… | x_refsource_MISC |
| https://github.com/prebid/prebid-server-java/rele… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| prebid | prebid-server-java |
Affected:
< 3.43.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54734",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:03:13.281651Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:03:23.515Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "prebid-server-java",
"vendor": "prebid",
"versions": [
{
"status": "affected",
"version": "\u003c 3.43.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can cause the server to send HTTP requests to unintended destinations, potentially reaching internal network services, metadata endpoints, or other sensitive server endpoints with the server\u0027s network access. This issue is fixed in version 3.43.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:59:45.873Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prebid/prebid-server-java/security/advisories/GHSA-fr2c-g2f8-qchg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prebid/prebid-server-java/security/advisories/GHSA-fr2c-g2f8-qchg"
},
{
"name": "https://github.com/prebid/prebid-server-java/pull/4522",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server-java/pull/4522"
},
{
"name": "https://github.com/prebid/prebid-server-java/commit/a129a685b6fc54441c1a779ce29ea4ec20c2e09f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server-java/commit/a129a685b6fc54441c1a779ce29ea4ec20c2e09f"
},
{
"name": "https://github.com/prebid/prebid-server-java/commit/d0c723ce36aa09712c825ea9625d978f45d29a1c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server-java/commit/d0c723ce36aa09712c825ea9625d978f45d29a1c"
},
{
"name": "https://github.com/prebid/prebid-server-java/releases/tag/3.43.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server-java/releases/tag/3.43.0"
}
],
"source": {
"advisory": "GHSA-fr2c-g2f8-qchg",
"discovery": "UNKNOWN"
},
"title": "Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54734",
"datePublished": "2026-09-17T21:59:45.873Z",
"dateReserved": "2026-06-15T23:07:33.233Z",
"dateUpdated": "2026-09-18T20:03:23.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54735 (GCVE-0-2026-54735)
Vulnerability from nvd – Published: 2026-07-29 15:59 – Updated: 2026-07-29 18:04
VLAI
EPSS
VEX
Title
prebid-server's request forgery vulnerability allows for possible host environment data extraction
Summary
Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-29 18:04 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/prebid/prebid-server/security/… | x_refsource_CONFIRM |
| https://github.com/prebid/prebid-server/pull/4802 | x_refsource_MISC |
| https://github.com/prebid/prebid-server/commit/49… | x_refsource_MISC |
| https://github.com/prebid/prebid-server/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| prebid | prebid-server |
Affected:
< 4.4.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54735",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T18:04:08.706808Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T18:04:18.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "prebid-server",
"vendor": "prebid",
"versions": [
{
"status": "affected",
"version": "\u003c 4.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T15:59:46.640Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx"
},
{
"name": "https://github.com/prebid/prebid-server/pull/4802",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server/pull/4802"
},
{
"name": "https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3"
},
{
"name": "https://github.com/prebid/prebid-server/releases/tag/v4.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server/releases/tag/v4.4.0"
}
],
"source": {
"advisory": "GHSA-4p3g-4hcj-wpvx",
"discovery": "UNKNOWN"
},
"title": "prebid-server\u0027s request forgery vulnerability allows for possible host environment data extraction"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54735",
"datePublished": "2026-07-29T15:59:46.640Z",
"dateReserved": "2026-06-15T23:07:33.233Z",
"dateUpdated": "2026-07-29T18:04:18.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-59039 (GCVE-0-2025-59039)
Vulnerability from nvd – Published: 2025-09-09 22:23 – Updated: 2025-09-10 18:00
VLAI
EPSS
VEX
Title
Prebid Universal Creative on npm briefly compromised
Summary
Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-10 17:47 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/prebid/prebid-universal-creati… | x_refsource_CONFIRM |
| https://www.sonatype.com/blog/npm-chalk-and-debug… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| prebid | prebid-universal-creative |
Affected:
= 1.17.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59039",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T17:47:53.143510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T18:00:27.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "prebid-universal-creative",
"vendor": "prebid",
"versions": [
{
"status": "affected",
"version": "= 1.17.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T22:23:55.551Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prebid/prebid-universal-creative/security/advisories/GHSA-m662-56rj-8fmm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prebid/prebid-universal-creative/security/advisories/GHSA-m662-56rj-8fmm"
},
{
"name": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack"
}
],
"source": {
"advisory": "GHSA-m662-56rj-8fmm",
"discovery": "UNKNOWN"
},
"title": "Prebid Universal Creative on npm briefly compromised"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59039",
"datePublished": "2025-09-09T22:23:55.551Z",
"dateReserved": "2025-09-08T16:19:26.171Z",
"dateUpdated": "2025-09-10T18:00:27.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-59038 (GCVE-0-2025-59038)
Vulnerability from nvd – Published: 2025-09-09 22:17 – Updated: 2025-09-10 18:02
VLAI
EPSS
VEX
Title
Prebid.js NPM package briefly compromised
Summary
Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the attackers' wallet. Version 10.10.0 fixes the issue. As a workaround, it is also possible to downgrade to 10.9.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-10 18:01 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/prebid/Prebid.js/security/advi… | x_refsource_CONFIRM |
| https://www.sonatype.com/blog/npm-chalk-and-debug… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59038",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T18:01:46.508749Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T18:02:00.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Prebid.js",
"vendor": "prebid",
"versions": [
{
"status": "affected",
"version": "= 10.9.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the attackers\u0027 wallet. Version 10.10.0 fixes the issue. As a workaround, it is also possible to downgrade to 10.9.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T22:17:08.493Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prebid/Prebid.js/security/advisories/GHSA-jwq7-6j4r-2f92",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prebid/Prebid.js/security/advisories/GHSA-jwq7-6j4r-2f92"
},
{
"name": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack"
}
],
"source": {
"advisory": "GHSA-jwq7-6j4r-2f92",
"discovery": "UNKNOWN"
},
"title": "Prebid.js NPM package briefly compromised"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59038",
"datePublished": "2025-09-09T22:17:08.493Z",
"dateReserved": "2025-09-08T16:19:26.171Z",
"dateUpdated": "2025-09-10T18:02:00.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-54734 (GCVE-0-2026-54734)
Vulnerability from cvelistv5 – Published: 2026-09-17 21:59 – Updated: 2026-09-18 20:03
VLAI
EPSS
VEX
Title
Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction
Summary
Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can cause the server to send HTTP requests to unintended destinations, potentially reaching internal network services, metadata endpoints, or other sensitive server endpoints with the server's network access. This issue is fixed in version 3.43.0.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:03 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/prebid/prebid-server-java/secu… | x_refsource_CONFIRM |
| https://github.com/prebid/prebid-server-java/pull/4522 | x_refsource_MISC |
| https://github.com/prebid/prebid-server-java/comm… | x_refsource_MISC |
| https://github.com/prebid/prebid-server-java/comm… | x_refsource_MISC |
| https://github.com/prebid/prebid-server-java/rele… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| prebid | prebid-server-java |
Affected:
< 3.43.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54734",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:03:13.281651Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:03:23.515Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "prebid-server-java",
"vendor": "prebid",
"versions": [
{
"status": "affected",
"version": "\u003c 3.43.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can cause the server to send HTTP requests to unintended destinations, potentially reaching internal network services, metadata endpoints, or other sensitive server endpoints with the server\u0027s network access. This issue is fixed in version 3.43.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:59:45.873Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prebid/prebid-server-java/security/advisories/GHSA-fr2c-g2f8-qchg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prebid/prebid-server-java/security/advisories/GHSA-fr2c-g2f8-qchg"
},
{
"name": "https://github.com/prebid/prebid-server-java/pull/4522",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server-java/pull/4522"
},
{
"name": "https://github.com/prebid/prebid-server-java/commit/a129a685b6fc54441c1a779ce29ea4ec20c2e09f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server-java/commit/a129a685b6fc54441c1a779ce29ea4ec20c2e09f"
},
{
"name": "https://github.com/prebid/prebid-server-java/commit/d0c723ce36aa09712c825ea9625d978f45d29a1c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server-java/commit/d0c723ce36aa09712c825ea9625d978f45d29a1c"
},
{
"name": "https://github.com/prebid/prebid-server-java/releases/tag/3.43.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server-java/releases/tag/3.43.0"
}
],
"source": {
"advisory": "GHSA-fr2c-g2f8-qchg",
"discovery": "UNKNOWN"
},
"title": "Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54734",
"datePublished": "2026-09-17T21:59:45.873Z",
"dateReserved": "2026-06-15T23:07:33.233Z",
"dateUpdated": "2026-09-18T20:03:23.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54735 (GCVE-0-2026-54735)
Vulnerability from cvelistv5 – Published: 2026-07-29 15:59 – Updated: 2026-07-29 18:04
VLAI
EPSS
VEX
Title
prebid-server's request forgery vulnerability allows for possible host environment data extraction
Summary
Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-29 18:04 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/prebid/prebid-server/security/… | x_refsource_CONFIRM |
| https://github.com/prebid/prebid-server/pull/4802 | x_refsource_MISC |
| https://github.com/prebid/prebid-server/commit/49… | x_refsource_MISC |
| https://github.com/prebid/prebid-server/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| prebid | prebid-server |
Affected:
< 4.4.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54735",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T18:04:08.706808Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T18:04:18.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "prebid-server",
"vendor": "prebid",
"versions": [
{
"status": "affected",
"version": "\u003c 4.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T15:59:46.640Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx"
},
{
"name": "https://github.com/prebid/prebid-server/pull/4802",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server/pull/4802"
},
{
"name": "https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3"
},
{
"name": "https://github.com/prebid/prebid-server/releases/tag/v4.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server/releases/tag/v4.4.0"
}
],
"source": {
"advisory": "GHSA-4p3g-4hcj-wpvx",
"discovery": "UNKNOWN"
},
"title": "prebid-server\u0027s request forgery vulnerability allows for possible host environment data extraction"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54735",
"datePublished": "2026-07-29T15:59:46.640Z",
"dateReserved": "2026-06-15T23:07:33.233Z",
"dateUpdated": "2026-07-29T18:04:18.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-59039 (GCVE-0-2025-59039)
Vulnerability from cvelistv5 – Published: 2025-09-09 22:23 – Updated: 2025-09-10 18:00
VLAI
EPSS
VEX
Title
Prebid Universal Creative on npm briefly compromised
Summary
Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-10 17:47 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/prebid/prebid-universal-creati… | x_refsource_CONFIRM |
| https://www.sonatype.com/blog/npm-chalk-and-debug… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| prebid | prebid-universal-creative |
Affected:
= 1.17.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59039",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T17:47:53.143510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T18:00:27.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "prebid-universal-creative",
"vendor": "prebid",
"versions": [
{
"status": "affected",
"version": "= 1.17.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T22:23:55.551Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prebid/prebid-universal-creative/security/advisories/GHSA-m662-56rj-8fmm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prebid/prebid-universal-creative/security/advisories/GHSA-m662-56rj-8fmm"
},
{
"name": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack"
}
],
"source": {
"advisory": "GHSA-m662-56rj-8fmm",
"discovery": "UNKNOWN"
},
"title": "Prebid Universal Creative on npm briefly compromised"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59039",
"datePublished": "2025-09-09T22:23:55.551Z",
"dateReserved": "2025-09-08T16:19:26.171Z",
"dateUpdated": "2025-09-10T18:00:27.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-59038 (GCVE-0-2025-59038)
Vulnerability from cvelistv5 – Published: 2025-09-09 22:17 – Updated: 2025-09-10 18:02
VLAI
EPSS
VEX
Title
Prebid.js NPM package briefly compromised
Summary
Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the attackers' wallet. Version 10.10.0 fixes the issue. As a workaround, it is also possible to downgrade to 10.9.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-10 18:01 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/prebid/Prebid.js/security/advi… | x_refsource_CONFIRM |
| https://www.sonatype.com/blog/npm-chalk-and-debug… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59038",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T18:01:46.508749Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T18:02:00.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Prebid.js",
"vendor": "prebid",
"versions": [
{
"status": "affected",
"version": "= 10.9.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the attackers\u0027 wallet. Version 10.10.0 fixes the issue. As a workaround, it is also possible to downgrade to 10.9.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T22:17:08.493Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prebid/Prebid.js/security/advisories/GHSA-jwq7-6j4r-2f92",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prebid/Prebid.js/security/advisories/GHSA-jwq7-6j4r-2f92"
},
{
"name": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack"
}
],
"source": {
"advisory": "GHSA-jwq7-6j4r-2f92",
"discovery": "UNKNOWN"
},
"title": "Prebid.js NPM package briefly compromised"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59038",
"datePublished": "2025-09-09T22:17:08.493Z",
"dateReserved": "2025-09-08T16:19:26.171Z",
"dateUpdated": "2025-09-10T18:02:00.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}