EUVD-2026-76054

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the jsondecode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php t...

CVE-2026-89242 WWBN AVideo Unauthenticated SSRF via login.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the jsondecode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php t...

Essity: Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████

An unauthenticated API was discovered that allowed reading, writing to, and deleting any user's private chat history on the organization's internal chatbot application. The API had no authentication mechanism in place, allowing an attacker to list all conversations, retrieve the complete message...

SUSE CVE-2026-53495

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or lifecycle hooks...

EUVD-2026-75779

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs...

CVE-2026-49865: Server-Side Request Forgery (SSRF)

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

CVE-2026-89242: Server-Side Request Forgery (SSRF)

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the jsondecode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php t...

CVE-2026-90446: Server-Side Request Forgery (SSRF)

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend...

CVE-2026-81213

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs...

CVE-2026-54054

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, POST /api/files/url, is vulnerable to Server-Side Request Forgery SSRF. The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects...

CVE-2026-54054

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0 , its URL import endpoint (POST /api/files/url) is vulnerable to full-read SSRF . The HTTP downloader fetches user-supplied URLs with redirects enabled and does not validate whether the targ...

CVE-2026-81213 Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs...

CVE-2026-81213

IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to Server-Side Request Forgery (SSRF) (CWE-918) due to missing egress validation on server-side URL fetches. Multiple components fail to apply the platform's shared SSRF guard: the MCP server configuration URL field, the automatic tool...

Exploit for CVE-2026-63642

SSRF in MagicMirror² Calendar Module A proof-of-concept explo...

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...

GHSA-4V28-J6Q3-5M4R Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...

EUVD-2026-75180

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader...

Server-side Request Forgery (SSRF)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the SafePlaywrightURLLoader process when the Playwright web loader engine is enabled. An attacker can access internal network resources and sensitive data by submitting a...

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...

Server-side Request Forgery (SSRF)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the server-side URL fetch process. An attacker can access internal network resources and retrieve sensitive information by submitting specially crafted URLs to the API...