https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 11:41:30 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-54735 <p>Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.</p> <p>Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-54735 https://vulnerability.circl.lu/vuln/ghsa-4p3g-4hcj-wpvx <p><strong>Affected:</strong> Go: github.com/prebid/prebid-server/v4, Go: github.com/prebid/prebid-server/v3, Go: github.com/prebid/prebid-server/v2, Go: github.com/prebid/prebid-server</p> <p>### Impact Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access.</p> <p>### Patches Patched in [v4.4.0](https://github.com/prebid/prebid-server/releases/tag/v4.4.0)</p> <p>### Workarounds If one is unable to update, please make sure that the affected bidder adapters are disabled.</p> <p><strong>Affected:</strong> Go: github.com/prebid/prebid-server/v4, Go: github.com/prebid/prebid-server/v3, Go: github.com/prebid/prebid-server/v2, Go: github.com/prebid/prebid-server</p> <p>### Impact Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access.</p> <p>### Patches Patched in [v4.4.0](https://github.com/prebid/prebid-server/releases/tag/v4.4.0)</p> <p>### Workarounds If one is unable to update, please make sure that the affected bidder adapters are disabled.</p> https://vulnerability.circl.lu/vuln/ghsa-4p3g-4hcj-wpvx