CVE-2026-53754

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker API server's SSRF protection validatewebhookurl / validateurldestination in deploy/docker/utils.py used an explicit IPv4/IPv6 CIDR blocklist that missed several address families. An attacker could reach...

CVE-2026-53754 Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker API server's SSRF protection validatewebhookurl / validateurldestination in deploy/docker/utils.py used an explicit IPv4/IPv6 CIDR blocklist that missed several address families. An attacker could reach...

CVE-2026-53755 Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through...

CVE-2026-53755

CVE-2026-53755 affects Crawl4AI up to version 0.8.9. The Docker API server fails to apply SSRF checks to proxy addresses, allowing an unauthenticated attacker to specify a proxy pointing at an internal IP while using a valid crawl URL. This can route Chromium egress through the proxy to reach int...

CVE-2026-53755 Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through...

CVE-2026-53755 Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through...

EUVD-2026-38567

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through...

CVE-2026-53755

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through...

Security update for docker-stable

This update for docker-stable fixes the following issues: CVE-2026-33997: Fixed privilege validation bypass during plugin bsc1265907. CVE-2026-34040: Fixed Authz zero length regression bsc1265929. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like...

SUSE-SU-2026:2579-1 Security update for docker-stable

This update for docker-stable fixes the following issues: - CVE-2026-33997: Fixed privilege validation bypass during plugin bsc1265907. - CVE-2026-34040: Fixed Authz zero length regression bsc1265929...

CVE-2026-56274

Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. An attacker with a Flowise account of any role, or API access with view/update permissions f...

GHSA-8678-W3JW-XFC2 vulnerabilities

Vulnerabilities for packages: pact-broker-docker-fips, pact-broker-docker, logstash-fips, ruby3.2-rails, kube-logging-operator, ruby3.3-rails, ruby4.0-rails, ruby3.4-rails, commercial-gitlab-rails-ee, logstash, gitlab-rails-ce...

GHSA-WFPW-MMFH-QQ69 vulnerabilities

Vulnerabilities for packages: pact-broker-docker-fips, pact-broker-docker, logstash-fips, ruby3.2-rails, kube-logging-operator, ruby3.3-rails, ruby4.0-rails, ruby3.4-rails, commercial-gitlab-rails-ee, logstash, gitlab-rails-ce...

GHSA-WJV4-X9W8-WM3H vulnerabilities

Vulnerabilities for packages: pact-broker-docker-fips, pact-broker-docker, logstash-fips, ruby3.2-rails, kube-logging-operator, ruby3.3-rails, ruby4.0-rails, ruby3.4-rails, commercial-gitlab-rails-ee, logstash, gitlab-rails-ce...

GHSA-5PRR-V3J2-97MH vulnerabilities

Vulnerabilities for packages: pact-broker-docker-fips, pact-broker-docker, logstash-fips, ruby3.2-rails, kube-logging-operator, ruby3.3-rails, ruby4.0-rails, ruby3.4-rails, commercial-gitlab-rails-ee, logstash, gitlab-rails-ce...

GHSA-5V8H-3H3Q-446P vulnerabilities

Vulnerabilities for packages: pact-broker-docker-fips, pact-broker-docker, logstash-fips, ruby3.2-rails, kube-logging-operator, ruby3.3-rails, ruby4.0-rails, ruby3.4-rails, commercial-gitlab-rails-ee, logstash, gitlab-rails-ce...

GHSA-9CV2-CFXC-V4V2 vulnerabilities

Vulnerabilities for packages: pact-broker-docker-fips, pact-broker-docker, logstash-fips, ruby3.2-rails, kube-logging-operator, ruby3.3-rails, ruby4.0-rails, ruby3.4-rails, commercial-gitlab-rails-ee, logstash, gitlab-rails-ce...

GHSA-P67V-3W7G-WJG7 vulnerabilities

Vulnerabilities for packages: pact-broker-docker-fips, pact-broker-docker, logstash-fips, ruby3.2-rails, kube-logging-operator, ruby3.3-rails, ruby4.0-rails, ruby3.4-rails, commercial-gitlab-rails-ee, logstash, gitlab-rails-ce...

GHSA-PHWJ-RPRQ-35PP vulnerabilities

Vulnerabilities for packages: pact-broker-docker-fips, pact-broker-docker, logstash-fips, ruby3.2-rails, kube-logging-operator, ruby3.3-rails, ruby4.0-rails, ruby3.4-rails, commercial-gitlab-rails-ee, logstash, gitlab-rails-ce...

CVE-2026-50195 vulnerabilities

Vulnerabilities for packages: grype-fips, helm, zarf-fips, tekton-pipelines, rancher, datadog-agent-fips, skaffold-fips, trivy, kube-arangodb-fips, helm-operator, manifest-tool, chartmuseum, kots, buildkitd-fips, helm-exporter-fips, redpanda-operator, spegel, xeol-fips, tw, skaffold, neuvector,...