Skip to content
OpenAdvisories

Vendor

prebid

4 known vulnerabilities.

Products

prebid-server 1 prebid-universal-creative 1 Prebid.js 1 prebid-server-java 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-54734

    Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction

    Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who ca…

    prebid prebid-server-java
  • Critical 10.0
    CVE-2026-54735

    prebid-server's request forgery vulnerability allows for possible host environment data extraction

    Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host…

    prebid prebid-server github.com/prebid/prebid-server/v3 github.com/prebid/prebid-server Go
  • Critical 9.3
    CVE-2025-59039

    Prebid Universal Creative on npm briefly compromised

    Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC un…

    prebid prebid-universal-creative prebid-universal-creative npm