https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 31 Jul 2026 17:53:11 +0000 https://vulnerability.circl.lu/sighting/5ff1f336-da7b-4337-9adc-4d8c4fb18bfa/export {"uuid": "5ff1f336-da7b-4337-9adc-4d8c4fb18bfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-54735", "content": "", "creation_timestamp": "2026-07-29T20:15:07.768816Z"} {"uuid": "5ff1f336-da7b-4337-9adc-4d8c4fb18bfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-54735", "content": "", "creation_timestamp": "2026-07-29T20:15:07.768816Z"} https://vulnerability.circl.lu/sighting/5ff1f336-da7b-4337-9adc-4d8c4fb18bfa/export Wed, 29 Jul 2026 20:15:07 +0000 https://vulnerability.circl.lu/sighting/b55097ef-79cf-4119-b9a4-69d0f44d81fb/export {"uuid": "b55097ef-79cf-4119-b9a4-69d0f44d81fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrsik6jv3n22", "content": "CVE-2026-54735 - prebid-server's request forgery vulnerability allows for possible host environment data extraction\nCVE ID : CVE-2026-54735\n \n Published : July 29, 2026, 4:17 p.m. | 1\u00a0hour, 26\u00a0minutes ago\n \n Description : Prebid Server is an open-source solution for running re...", "creation_timestamp": "2026-07-29T17:53:00.317369Z"} {"uuid": "b55097ef-79cf-4119-b9a4-69d0f44d81fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrsik6jv3n22", "content": "CVE-2026-54735 - prebid-server's request forgery vulnerability allows for possible host environment data extraction\nCVE ID : CVE-2026-54735\n \n Published : July 29, 2026, 4:17 p.m. | 1\u00a0hour, 26\u00a0minutes ago\n \n Description : Prebid Server is an open-source solution for running re...", "creation_timestamp": "2026-07-29T17:53:00.317369Z"} https://vulnerability.circl.lu/sighting/b55097ef-79cf-4119-b9a4-69d0f44d81fb/export Wed, 29 Jul 2026 17:53:00 +0000 https://vulnerability.circl.lu/sighting/c91aa657-457d-4824-83ec-1c4b46e476a5/export {"uuid": "c91aa657-457d-4824-83ec-1c4b46e476a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrsezo76df2q", "content": "CVE-2026-54735 - prebid\nThe Prebid Server's request handling system can be tricked into sending requests to unauthorized destinations, potentially exposing internal services to malicious actors. This could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#prebid #Golang #CVE #infosec", "creation_timestamp": "2026-07-29T16:50:04.964411Z"} {"uuid": "c91aa657-457d-4824-83ec-1c4b46e476a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrsezo76df2q", "content": "CVE-2026-54735 - prebid\nThe Prebid Server's request handling system can be tricked into sending requests to unauthorized destinations, potentially exposing internal services to malicious actors. This could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#prebid #Golang #CVE #infosec", "creation_timestamp": "2026-07-29T16:50:04.964411Z"} https://vulnerability.circl.lu/sighting/c91aa657-457d-4824-83ec-1c4b46e476a5/export Wed, 29 Jul 2026 16:50:04 +0000 https://vulnerability.circl.lu/sighting/a6cb391a-c63a-4f66-9610-0069d52e9e0a/export {"uuid": "a6cb391a-c63a-4f66-9610-0069d52e9e0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://gist.github.com/alon710/fffec7ff7a3f093df17d5e871ff03c84", "content": "# CVE-2026-54735: CVE-2026-54735: Critical Server-Side Request Forgery (SSRF) in Prebid Server Bidder Adapters\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54735\n\n## Summary\nCVE-2026-54735 is a critical Server-Side Request Forgery (SSRF) vulnerability in Prebid Server's bidder adapters, allowing unauthenticated remote attackers to route HTTP requests to arbitrary locations, including internal local host loopbacks and cloud provider metadata endpoints.\n\n## TL;DR\nPrebid Server versions prior to 4.4.0 fail to validate or sanitize dynamic host and subdomain parameters within several bidder adapters. This allows unauthenticated remote attackers to manipulate the destination of outbound HTTP requests by supplying control characters in OpenRTB requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v3.1**: 10.0 (Critical)\n- **Exploit Status**: Proof of Concept available\n- **CISA KEV Status**: Not listed\n- **Impact**: Server-Side Request Forgery, Local Host Enumeration, Credential Disclosure\n\n## Affected Systems\n\n- Prebid Server\n- **prebid-server**: < 4.4.0 (Fixed in: `4.4.0`)\n\n## Mitigation\n\n- Upgrade to Prebid Server version 4.4.0 or above\n- Configure outbound egress firewalls to block private IP ranges (RFC 1918) and link-local addresses\n- Implement DNS resolution filters inside the container network\n\n**Remediation Steps:**\n1. Identify all active Prebid Server instances and map their respective current versions\n2. Execute upgrade processes to update the prebid-server image or binary to version 4.4.0 or newer\n3. Deploy updated network security policies or firewall rules to limit Prebid Server's outbound egress to public IP endpoints\n4. Verify the mitigation using test payloads matching invalid-host structures\n\n## References\n\n- [GitHub Security Advisory GHSA-4p3g-4hcj-wpvx](https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54735) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T16:32:11.749626Z"} {"uuid": "a6cb391a-c63a-4f66-9610-0069d52e9e0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://gist.github.com/alon710/fffec7ff7a3f093df17d5e871ff03c84", "content": "# CVE-2026-54735: CVE-2026-54735: Critical Server-Side Request Forgery (SSRF) in Prebid Server Bidder Adapters\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54735\n\n## Summary\nCVE-2026-54735 is a critical Server-Side Request Forgery (SSRF) vulnerability in Prebid Server's bidder adapters, allowing unauthenticated remote attackers to route HTTP requests to arbitrary locations, including internal local host loopbacks and cloud provider metadata endpoints.\n\n## TL;DR\nPrebid Server versions prior to 4.4.0 fail to validate or sanitize dynamic host and subdomain parameters within several bidder adapters. This allows unauthenticated remote attackers to manipulate the destination of outbound HTTP requests by supplying control characters in OpenRTB requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v3.1**: 10.0 (Critical)\n- **Exploit Status**: Proof of Concept available\n- **CISA KEV Status**: Not listed\n- **Impact**: Server-Side Request Forgery, Local Host Enumeration, Credential Disclosure\n\n## Affected Systems\n\n- Prebid Server\n- **prebid-server**: < 4.4.0 (Fixed in: `4.4.0`)\n\n## Mitigation\n\n- Upgrade to Prebid Server version 4.4.0 or above\n- Configure outbound egress firewalls to block private IP ranges (RFC 1918) and link-local addresses\n- Implement DNS resolution filters inside the container network\n\n**Remediation Steps:**\n1. Identify all active Prebid Server instances and map their respective current versions\n2. Execute upgrade processes to update the prebid-server image or binary to version 4.4.0 or newer\n3. Deploy updated network security policies or firewall rules to limit Prebid Server's outbound egress to public IP endpoints\n4. Verify the mitigation using test payloads matching invalid-host structures\n\n## References\n\n- [GitHub Security Advisory GHSA-4p3g-4hcj-wpvx](https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54735) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T16:32:11.749626Z"} https://vulnerability.circl.lu/sighting/a6cb391a-c63a-4f66-9610-0069d52e9e0a/export Wed, 29 Jul 2026 16:32:11 +0000