https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T11:41:30.493040+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-54735 fkie_cve-2026-54735 2026-10-04T11:41:30.778884+00:00

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.

 https://vulnerability.circl.lu/vuln/ghsa-4p3g-4hcj-wpvx GHSA-4p3g-4hcj-wpvx — prebid-server's request forgery vulnerability allows for possible host environment data extraction 2026-10-04T11:41:30.778980+00:00

Affected: Go: github.com/prebid/prebid-server/v4, Go: github.com/prebid/prebid-server/v3, Go: github.com/prebid/prebid-server/v2, Go: github.com/prebid/prebid-server

### Impact Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access.

### Patches Patched in [v4.4.0](https://github.com/prebid/prebid-server/releases/tag/v4.4.0)

### Workarounds If one is unable to update, please make sure that the affected bidder adapters are disabled.