CVE-2026-49129: Server-Side Request Forgery (SSRF)

Music Player Daemon MPD before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPTFOLLOWLOCATION is set without CURLOPTREDIRPROTOCOLSSTR, allowing unauthenticated attackers to bypass the http/https scheme restriction by causing a malicious HTTP...

CVE-2026-43879: Server-Side Request Forgery (SSRF)

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an authenticated user can configure their own donation-notification webhook URL to point at internal/loopback/metadata hosts e.g. http://127.0.0.1:8080/..., http://169.254.169.254/latest/..., RFC1918 addresses. Wh...

EUVD-2006-4471

Malware in sbrugna...

CVE-2009-0037: Cross-Site Request Forgery (CSRF)

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to 1 trigger arbitrary requests to intranet servers, 2 read or overwrite arbitrary files via a redirect to a file:...

CVE-2006-4483

CVE-2006-4483 affects PHP 5.1.x before 5.1.5, specifically the curl extension files ext/curl/interface.c and ext/curl/streams.c. When open_basedir or safe_mode are enabled, CURLOPT_FOLLOWLOCATION is permitted, which can enable unauthorized actions and may relate to the realpath cache. Public advi...

CVE-2006-4483: Missing Authorization

The cURL extension files 1 ext/curl/interface.c and 2 ext/curl/streams.c in PHP before 5.1.5 permit the CURLOPTFOLLOWLOCATION option when openbasedir or safemode is enabled, which allows attackers to perform unauthorized actions, possibly related to the realpath cache...