CVE-2026-33340

CVE-2026-33340: SSRF en lollms-webui Descripción general Campo| Detalle ---|--- ID CVE| CVE-2026-33340 Vulnerabilidad| Falsificación de solicitudes del lado del servidor Server-Side Request Forgery, SSRF Producto afectado| ParisNeo/lollms-webui LoLLMS WEBUI Gravedad| Crítica — CVSS 9.1 Vector CVS...

CVE-2026-72777

Next AI Draw.io

CVE-2026-72552 Dub Dub - Server-Side Request Forgery

A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller-supplied URL without applying a denylist or...

MAL-2026-11001 Malicious code in date-format-utils-xz (npm)

The npm package date-format-utils-xz masquerades as a date-formatting utility but is malicious. Its own decoy index.js is prefaced with a Chinese comment translating to "disguised as a normal date formatting tool." Every published version 1.0.0-1.0.4 declares a postinstall lifecycle hook...

PYSEC-2026-497 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

Summary PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive...

pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

SummaryPyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive...

PT-2026-53571

Summary PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive...

EUVD-2026-21573

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain...

CVE-2026-40175

The Axios promise-based HTTP client for the browser and Node.js is vulnerable to a gadget-style attack chain . Specifically, prototype pollution in a third-party dependency can be leveraged to inject unsanitized header values into outbound requests. This flaw may lead to unrestricted cloud metada...

CVE-2026-40175 Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This...

Server-side Request Forgery (SSRF)

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the /api/addPackage endpoint. An attacker can access internal network services and exfiltrate sensitive cloud metadata b...

GHSA-M74M-F7CR-432X pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

Summary PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive...

PT-2026-27456

Name of the Vulnerable Software and Affected Versions LoLLMs WEBUI affected versions not specified Description LoLLMs WEBUI, the web user interface for Lord of Large Language and Multi modal Systems, contains a Server-Side Request Forgery SSRF issue. An unauthenticated attacker can exploit this t...