281 matches found
Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008
The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL...
PT-2026-50609
Name of the Vulnerable Software and Affected Versions Drupal core affected versions not specified Description The Media module supports oEmbed, which utilizes two discovery mechanisms: providers.json and URL discovery. The URL discovery code can be exploited to trick the system into making...
CVE-2026-34428
Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is passed directly to getUrl via curl without scheme or destination validation. Authenticated backend users can supply file:// URLs to read...
GHSA-HH8V-HGVP-G3F5 league/commonmark has an embed extension allowed_domains bypass
Impact The DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This enabl...
BIT-GHOST-2025-9862 Ghost 6.0.6 - SSRF via oEmbed Bookmark
Server-Side Request Forgery SSRF vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3...
CVE-2017-6514
WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information Path Disclosure via a /wp-json/oembed/1.0/embed?url= request, related to the "authorname":" substring...
PT-2026-26486
Name of the Vulnerable Software and Affected Versions league/commonmark versions 2.3.0 through 2.8.1 Description The DomainFilteringAdapter within the Embed extension is susceptible to an allowlist bypass because of a missing hostname boundary assertion in the domain-matching regular expression. ...
Rocket.Chat: SSRF via Improper Redirect Validation in Rocket.Chat oEmbed Function
A vulnerability was discovered in Rocket.Chat version 7.10.1 where the oEmbed feature did not properly validate redirected URLs. This allowed an attacker to bypass SSRF protections and access internal network resources that would otherwise be unreachable...
EUVD-2016-6771
Malware in sbrugna...
EUVD-2019-0320
Malware in sbrugna...
EUVD-2019-19226
Malware in sbrugna...
EUVD-2013-2157
Malware in sbrugna...
EUVD-2017-6221
Malware in sbrugna...
EUVD-2023-1196
Malicious code in bioql PyPI...
EUVD-2023-0141
Malicious code in bioql PyPI...
EUVD-2025-14932
Malicious code in bioql PyPI...
EUVD-2024-22460
Malicious code in bioql PyPI...
EUVD-2025-29242
Malicious code in bioql PyPI...