CVE-2026-49129: Server-Side Request Forgery (SSRF)

Music Player Daemon MPD before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPTFOLLOWLOCATION is set without CURLOPTREDIRPROTOCOLSSTR, allowing unauthenticated attackers to bypass the http/https scheme restriction by causing a malicious HTTP...

CVE-2026-43879: Server-Side Request Forgery (SSRF)

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an authenticated user can configure their own donation-notification webhook URL to point at internal/loopback/metadata hosts e.g. http://127.0.0.1:8080/..., http://169.254.169.254/latest/..., RFC1918 addresses. Wh...

EUVD-2006-4471

Malware in sbrugna...

CVE-2006-4483

CVE-2006-4483 affects PHP 5.1.x before 5.1.5, specifically the curl extension files ext/curl/interface.c and ext/curl/streams.c. When open_basedir or safe_mode are enabled, CURLOPT_FOLLOWLOCATION is permitted, which can enable unauthorized actions and may relate to the realpath cache. Public advi...