Refine your search
4 vulnerabilities found for by prebid
CVE-2026-54734 (GCVE-0-2026-54734)
Vulnerability from cvelistv5
Published
2026-09-17 21:59
Modified
2026-09-18 20:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Summary
Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can cause the server to send HTTP requests to unintended destinations, potentially reaching internal network services, metadata endpoints, or other sensitive server endpoints with the server's network access. This issue is fixed in version 3.43.0.
References
| URL | Tags | |
|---|---|---|
|
|
||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| prebid | prebid-server-java |
Version: < 3.43.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54734",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:03:13.281651Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:03:23.515Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "prebid-server-java",
"vendor": "prebid",
"versions": [
{
"status": "affected",
"version": "\u003c 3.43.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can cause the server to send HTTP requests to unintended destinations, potentially reaching internal network services, metadata endpoints, or other sensitive server endpoints with the server\u0027s network access. This issue is fixed in version 3.43.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:59:45.873Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prebid/prebid-server-java/security/advisories/GHSA-fr2c-g2f8-qchg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prebid/prebid-server-java/security/advisories/GHSA-fr2c-g2f8-qchg"
},
{
"name": "https://github.com/prebid/prebid-server-java/pull/4522",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server-java/pull/4522"
},
{
"name": "https://github.com/prebid/prebid-server-java/commit/a129a685b6fc54441c1a779ce29ea4ec20c2e09f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server-java/commit/a129a685b6fc54441c1a779ce29ea4ec20c2e09f"
},
{
"name": "https://github.com/prebid/prebid-server-java/commit/d0c723ce36aa09712c825ea9625d978f45d29a1c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server-java/commit/d0c723ce36aa09712c825ea9625d978f45d29a1c"
},
{
"name": "https://github.com/prebid/prebid-server-java/releases/tag/3.43.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server-java/releases/tag/3.43.0"
}
],
"source": {
"advisory": "GHSA-fr2c-g2f8-qchg",
"discovery": "UNKNOWN"
},
"title": "Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54734",
"datePublished": "2026-09-17T21:59:45.873Z",
"dateReserved": "2026-06-15T23:07:33.233Z",
"dateUpdated": "2026-09-18T20:03:23.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54735 (GCVE-0-2026-54735)
Vulnerability from cvelistv5
Published
2026-07-29 15:59
Modified
2026-07-29 18:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Summary
Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| prebid | prebid-server |
Version: < 4.4.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54735",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T18:04:08.706808Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T18:04:18.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "prebid-server",
"vendor": "prebid",
"versions": [
{
"status": "affected",
"version": "\u003c 4.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T15:59:46.640Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx"
},
{
"name": "https://github.com/prebid/prebid-server/pull/4802",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server/pull/4802"
},
{
"name": "https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3"
},
{
"name": "https://github.com/prebid/prebid-server/releases/tag/v4.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prebid/prebid-server/releases/tag/v4.4.0"
}
],
"source": {
"advisory": "GHSA-4p3g-4hcj-wpvx",
"discovery": "UNKNOWN"
},
"title": "prebid-server\u0027s request forgery vulnerability allows for possible host environment data extraction"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54735",
"datePublished": "2026-07-29T15:59:46.640Z",
"dateReserved": "2026-06-15T23:07:33.233Z",
"dateUpdated": "2026-07-29T18:04:18.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-59039 (GCVE-0-2025-59039)
Vulnerability from cvelistv5
Published
2025-09-09 22:23
Modified
2025-09-10 18:00
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-506 - Embedded Malicious Code
Summary
Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| prebid | prebid-universal-creative |
Version: = 1.17.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59039",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T17:47:53.143510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T18:00:27.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "prebid-universal-creative",
"vendor": "prebid",
"versions": [
{
"status": "affected",
"version": "= 1.17.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T22:23:55.551Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prebid/prebid-universal-creative/security/advisories/GHSA-m662-56rj-8fmm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prebid/prebid-universal-creative/security/advisories/GHSA-m662-56rj-8fmm"
},
{
"name": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack"
}
],
"source": {
"advisory": "GHSA-m662-56rj-8fmm",
"discovery": "UNKNOWN"
},
"title": "Prebid Universal Creative on npm briefly compromised"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59039",
"datePublished": "2025-09-09T22:23:55.551Z",
"dateReserved": "2025-09-08T16:19:26.171Z",
"dateUpdated": "2025-09-10T18:00:27.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-59038 (GCVE-0-2025-59038)
Vulnerability from cvelistv5
Published
2025-09-09 22:17
Modified
2025-09-10 18:02
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-506 - Embedded Malicious Code
Summary
Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the attackers' wallet. Version 10.10.0 fixes the issue. As a workaround, it is also possible to downgrade to 10.9.1.
References
| URL | Tags | |
|---|---|---|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59038",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T18:01:46.508749Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T18:02:00.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Prebid.js",
"vendor": "prebid",
"versions": [
{
"status": "affected",
"version": "= 10.9.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the attackers\u0027 wallet. Version 10.10.0 fixes the issue. As a workaround, it is also possible to downgrade to 10.9.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T22:17:08.493Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prebid/Prebid.js/security/advisories/GHSA-jwq7-6j4r-2f92",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prebid/Prebid.js/security/advisories/GHSA-jwq7-6j4r-2f92"
},
{
"name": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack"
}
],
"source": {
"advisory": "GHSA-jwq7-6j4r-2f92",
"discovery": "UNKNOWN"
},
"title": "Prebid.js NPM package briefly compromised"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59038",
"datePublished": "2025-09-09T22:17:08.493Z",
"dateReserved": "2025-09-08T16:19:26.171Z",
"dateUpdated": "2025-09-10T18:02:00.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}