6799 matches found
CVE-2026-70591
Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...
EUVD-2026-52973
Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...
Ghost: Mobiledoc image-size fetch SSRF
Impact When re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card a...
NPM: Ghost: Mobiledoc image-size fetch SSRF
NPM: Ghost: Mobiledoc image-size fetch SSRF vulnerability discovered by ? in WordPress Npm ghost versions = 6.19.4, 6.21.1...
GHSA-G366-23FW-GGP6 Ghost: Mobiledoc image-size fetch SSRF
Impact When re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card a...
MAL-2026-11526 Malicious code in nagix-nodejs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8ce2f0b04a8b6a69d540678c440c14c0c4b9b5a6cf6a957e020aceff239c279 package.json declares "postinstall": "node test.js", which auto-executes on npm install and invokes two exported routines in index.js. The first...
MAL-2026-11525 Malicious code in nagix-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c77b8796f45d4e9888fe751dac62ad9f85334f29a64d8b0b2f50377611d6fc package.json declares postinstall: node test.js, which auto-executes on npm install and performs three attacker-beneficial actions against the...
Open WebUI: DNS Rebinding SSRF Bypass
Summary Open WebUI vetted user-supplied URLs by resolving the hostname once and rejecting private, loopback and link-local addresses, then let the HTTP client resolve that hostname again at connect time. An attacker who controls the authoritative DNS for a hostname they submit can answer with a...
CLSA-2026-1776299664 TuxCare security update for npm-registry-fetch (1 CVE)
TuxCare rebuilt npm-registry-fetch to address 1 CVE. Fixed in 3.9.1-tuxcare.1...
CLSA-2026-1775003170 TuxCare security update for node-fetch (1 CVE)
TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.7.3-tuxcare.1...
CLSA-2026-1775003167 TuxCare security update for node-fetch (1 CVE)
TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.6.3-tuxcare.1...
CLSA-2026-1775003169 TuxCare security update for node-fetch (1 CVE)
TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 2.6.1-tuxcare.1...
linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect
Summarylib.url.fetch follows HTTP redirects followredirects=True. httpx strips only Authorization and Cookie when a redirect crosses the origin, so any other caller-supplied credential header a session token such as Redfish's X-Auth-Token, an API key, ... was still sent to the redirect target. A...
datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas
SummaryWhen datamodel-code-generator fetches a remote schema and follows an HTTP redirect, it re-sends the original request headers, including any Authorization header, to the redirect target even when the redirect changes origin host/port/scheme. Credentials that an operator scoped to a trusted...
Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching
SummaryThe administrator-configured WEBFETCHFILTERLIST the allow/block list applied to server-side web fetches: RAG URL ingestion, URL-to-markdown, web-search content fetch matches hostnames incorrectly, so the filter can be bypassed. Detailsisstringallowed backend/openwebui/utils/misc.py matches...
PYSEC-2026-3603 Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching
Summary The administrator-configured WEBFETCHFILTERLIST the allow/block list applied to server-side web fetches: RAG URL ingestion, URL-to-markdown, web-search content fetch matches hostnames incorrectly, so the filter can be bypassed. Details isstringallowed backend/openwebui/utils/misc.py match...
PYSEC-2026-3580 Nanobot contains a server-side request forgery vulnerability in the web_fetch tool
Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the webfetch tool that allows remote attackers to reach internal or private network hosts by supplying a URL that redirects to a loopback or private address via a 3xx Location header. Attackers can exploit the...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Vitejs Vite
CVE-2026-39363 – Vite Dev Server Arbitrary File Reading PoC A...
