CVE-2026-54735Critical· 10.0▾ Midnightprebid-server's request forgery vulnerability allows for possible host environment data extraction
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 55 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.4%
Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access.
Patched in v4.4.0
If one is unable to update, please make sure that the affected bidder adapters are disabled.
github.com/prebid/prebid-server/v4 < 4.4.0github.com/prebid/prebid-server/v3 <= 3.30.0github.com/prebid/prebid-server/v2 <= 2.32.0github.com/prebid/prebid-server <= 0.275.0Upgrade to a patched release:
github.com/prebid/prebid-server/v4 4.4.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-68616High· 7.5WeasyPrint helps web developers to create PDF documents
CVE-2026-54734Critical· 10.0Prebid Server Java is the Java version of Prebid Server
CVE-2026-12992High· 7.4A flaw was found in Apicurio Registry
CVE-2021-21985Critical· 9.8The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server
CVE-2021-21975High· 7.5Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal…
CVE-2021-26855Critical· 9.1Microsoft Exchange Server Remote Code Execution Vulnerability