CVE-2026-110113 PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint

PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to...

CVE-2026-110113

PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to...

UBUNTU-CVE-2026-108735

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxyurl. Attackers can point proxyurl at loopback or internal hosts, bypassing FETCHERALLOWPRIVATENETWORKS checks to probe internal...

CVE-2022-22972-

CVE-2022-22972-IOC List IP ADRESSES • 23.36.163.250 • 64.32.6.143 • 217.175.49.100 HASH • 6f17c8af555321cca16fe1695cc420eb9079fd187b8fa71d840f3cfd1f796117 • 040db8eacbd482c12ba03ab1a7c738be • 97ac734b671c815c43ea3287732046d2177e5bdad63e12315acc4902b8baa04d •...

DEBIAN-CVE-2026-109378

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recupererurl in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with validerurldistante. Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote...

CVE-2026-109378

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recupererurl in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with validerurldistante. Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote...

EUVD-2026-97876

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recupererurl in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with validerurldistante. Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote...

EUVD-2026-97682

Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling linkpreviewconfig on /crawl requests. Attackers can supply a controlled page with includeexternal and includepatterns set, causing AsyncUrlSeeder to fet...

CVE-2026-109238 Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder

Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling linkpreviewconfig on /crawl requests. Attackers can supply a controlled page with includeexternal and includepatterns set, causing AsyncUrlSeeder to fet...

CVE-2026-109238

The Crawl4AI library versions 0.7.0 before 0.9.4 is vulnerable to a Server-Side Request Forgery (SSRF) . This flaw exists in the AsyncUrlSeeder component when link_preview_config is enabled on /crawl requests. An attacker can provide a controlled page with specific include_external and include_pa...

CVE-2026-109238 Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder

Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling linkpreviewconfig on /crawl requests. Attackers can supply a controlled page with includeexternal and includepatterns set, causing AsyncUrlSeeder to fet...

CVE-2026-109169

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, emai...

CVE-2026-109169 LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, emai...

ph0neutria

ph0neutria ph0neutria malware crawler v1.0.1 https://github.com/phage-nz/ph0neutria Note: This project is not actively maintained. About ph0neutria is a malware zoo builder that sources samples straight from the wild. Everything is stored in Viper for ease of access and manageability. This projec...

CVE-2026-109179 jshERP through 3.6 Missing Authorization via /log/list and /log/info

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege users can send GET requests to /log/list or /log/info to view other users' login names, client IP addresses, and actions...

CVE-2026-33626-Lab

CVE-2026-33626 — LMDeploy Vision-Language SSRF Lab Overview This repository reproduces CVE-2026-33626 , a Server-Side Request Forgery SSRF vulnerability in LMDeploy's vision-language image loading path. The vulnerable behavior occurs when LMDeploy receives an image URL and the server-side image...

PT-2026-110655

Name of the Vulnerable Software and Affected Versions Crawl4AI versions 0.7.0 through 0.9.3 Description A server-side request forgery SSRF issue exists where API clients can access internal addresses. By enabling link preview config on the '/crawl' endpoint, an attacker can provide a controlled...

Linux Distros Unpatched Vulnerability : CVE-2026-108735

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed'...

CVE-2019-19781_IOCs

CVE-2019-19781IOCs IOCs for CVE-2019-19781 citrixhoneypotnslookup.txt contains whois results for the IP addresses listed in ips.txt. these were the addresses that showed up most frequently in the logs of the honeypot discussed here:...

Identificador-CVE-2018-11759

Other language git - pt-BR Check if your instances are expose the CVE 2018-11759 The archive main are a script in bash for exploiting. The urls shall use the protocol and complete addres, example: https://test.site.com.br For more urls in one consult, can be used the here-document, example: Call...