nextjs-cve-2026-44578

nextjs-cve-2026-44578 Nuclei templates for detecting CVE-2026-44578 Next.js WebSocket Upgrade SSRF with multi-cloud metadata validation, Next.js fingerprinting, and real-world scanning workflows. Includes references to the original NextSSRF research and exploit tooling. NextSSRF Nuclei Templates...

FormCraft3 <= 3.9.15 - Server-Side Request Forgery

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions. id: CVE-2026-65442 info: name: FormCraft3 = 3.9.15 - Server-Side Request Forgery author: DhiyaneshDk severity: high description: | Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

Kan <= 0.5.4 - Server-Side Request Forgery

Kan, an open-source project management tool Trello alternative, versions 0.5.4 and below are vulnerable to an unauthenticated Server-Side Request Forgery in the /api/download/attatchment endpoint. The endpoint passes the attacker-controlled url query parameter straight to a server-side fetch...

Gotenberg <= 8.30.1 - Server Side Request Forgery

Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression ^https?:// to match URL schemes. Because Go's net/url.Parse normalizes...

Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. id: CVE-2026-60105 info: name: Monst...

MagicMirror <= 2.35.0 - Server-Side Request Forgery

An unauthenticated Server-Side Request Forgery SSRF vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment...

CVE-2026-77294

TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llmbaseurl through the settings API when the LLMPARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted impo...

CVE-2026-34160

CVE-2026-34160 — Unauthenticated SSRF in Chamilo LMS via PENS plugin pens.php Severity : High CVSS 8.6 CWE : CWE-918 Server-Side Request Forgery Affected : chamilo/chamilo-lms 2.0-RC.2 Fixed in : 2.0-RC.3 Advisory : GHSA-g2xj-4cch-j276 NVD : https://nvd.nist.gov/vuln/detail/CVE-2026-34160 Credit ...

CVE-2026-33752

CVE-2026-33752 CVE-2026-33752 SSRF basado en redirecciones que permite el acceso a la red interna en curlcffi Resumen curlcffi no restringe las solicitudes a rangos de IP internos y sigue las redirecciones automáticamente mediante la librería subyacente libcurl. Debido a esto, una URL controlada...

CVE-2026-77294 TREK: Server-Side Request Forgery via User-Configurable LLM Base URL

TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llmbaseurl through the settings API when the LLMPARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted impo...

EUVD-2026-86338

TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llmbaseurl through the settings API when the LLMPARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted impo...

CVE-2026-77294

The collaborative travel planner TREK is vulnerable to a Server-Side Request Forgery (SSRF) in versions prior to 3.3.0 . When the LLM_PARSING feature is enabled, an authenticated user with write permissions to a trip instance can store an attacker-controlled llm_base_url via the settings API. The...

poc-cve-2026-32255

Kan SSRF mediante Descarga de Adjuntos CVE-2026-32255 - Prueba de Concepto Este repositorio contiene una prueba de concepto POC para CVE-2026-32255 , una vulnerabilidad de Server-Side Request Forgery SSRF de alta severidad en Kan , una herramienta de gestión de proyectos de código abierto. El...

CVE-2026-64849.yaml

id: CVE-2026-64849 info: name: MLflow Webhook SSRF - Lectura completa no autenticada mediante bypass de redirección author: DhiyaneshDk severity: critical description: | MLflow 3.15.0 contiene una vulnerabilidad de divulgación de información causada por una validación incorrecta de las URL de los...

EUVD-2026-86199

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts an authenticated user's url query parameter and passes it to http.get or https.get without destination restrictions. In...

CVE-2026-79764

The web-based server management platform Termix versions 2.5.0 through 2.5.1 is vulnerable to an authenticated Server-Side Request Forgery (SSRF) . The /homepage/proxy endpoint accepts a user-provided URL and passes it to http.get or https.get without a destination allowlist. Specifically, the sr...

CVE-2026-79764 Termix: Authenticated SSRF via `/homepage/proxy` — No Destination Allowlist

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts an authenticated user's url query parameter and passes it to http.get or https.get without destination restrictions. In...

CVE-2026-67620-poc

CVE-2026-67620 — Flowise SSRF via incomplete cloud-metadata deny-list Oracle OCI + Alibaba Cloud Product: FlowiseAI/Flowise — visual LLM / AI-agent builder 54k ★ Affected versions: ≤ 3.1.4 — confirmed still vulnerable in 3.1.4 , the latest release re-verified 2026-08-06 Vulnerability: Server-Side...

CVE-2026-3333-DNS-Rebinding-to-Steal-Cloud-Metadata

CVE-2026-3333 – DNS Rebinding para robar metadatos de la nube Código del programa servidor atacante en Python + aplicación vulnerable root@kitploit: !/usr/bin/env python3 dnsrebindingserver.py - Malicious DNS server that alternates between attacker IP and 169.254.169.254 import socket, threading,...

CVE-2026-33340

CVE-2026-33340: SSRF en lollms-webui Descripción general Campo| Detalle ---|--- ID CVE| CVE-2026-33340 Vulnerabilidad| Falsificación de solicitudes del lado del servidor Server-Side Request Forgery, SSRF Producto afectado| ParisNeo/lollms-webui LoLLMS WEBUI Gravedad| Crítica — CVSS 9.1 Vector CVS...