Lucene search
+L

94353 matches found

CVE
CVE
added 2026/07/29 6:35 p.m.62 views

CVE-2026-67425

CVE-2026-67425 affects Flyto2 Core. Prior to version 2.26.6, the component llm.chat reads provider keys (e.g., OPENAI_API_KEY, ANTHROPOLIC_API_KEY) from the environment and transmits them in an Authorization: Bearer header to a caller-controlled base_url, enabling an attacker to exfiltrate the op...

8.6CVSS6AI score0.0032EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/29 6:32 p.m.9 views

CVE-2026-16328 consul-mcp-server vulnerable to server side request forgery leading to token exposure

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an...

8.6CVSS5.8AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/29 6:32 p.m.62 views

CVE-2026-16328 consul-mcp-server vulnerable to server side request forgery leading to token exposure

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an...

8.6CVSS0.00232EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/29 6:19 p.m.36 views

CVE-2026-2482

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 are affected by a cross-site request forgery (CSRF) vulnerability when the collectiveController-1.0 feature is enabled. The issue could allow an attacker to execute malicious and unauthorized actions transmitted from a tr...

8.8CVSS5.9AI score0.00098EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/07/29 6:19 p.m.70 views

CVE-2026-2482 IBM WebSphere Application Server Liberty is affected by a cross-site request forgery

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

3.1CVSS0.00098EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/29 6:19 p.m.18 views

EUVD-2026-50448

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

3.1CVSS5.9AI score0.00098EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/29 6:16 p.m.13 views

CVE-2026-18236

A vulnerability in the Agent Development Kit ADK allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework di...

10CVSS0.00376EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/29 6:15 p.m.77 views

CVE-2026-14529

IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Server Liberty 17.0.0.3–26.0.0.8 are affected by SSRF when the SIP container feature sipServlet-1.1 is enabled. The vulnerability (CVE-2026-14529) is CVSSv3.1 base score 9.4 (CRITICAL) with an attack vector of NE...

9.8CVSS5.9AI score0.00395EPSS
SaveExploits0References1Affected Software1
EUVD
EUVD
added 2026/07/29 6:15 p.m.14 views

EUVD-2026-50447

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery SSRF when the SIP container feature sipServlet-1.1 is enabled...

9.4CVSS5.9AI score0.00395EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/29 6:15 p.m.43 views

CVE-2026-14529 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery SSRF when the SIP container feature sipServlet-1.1 is enabled...

9.4CVSS0.00395EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/29 6:12 p.m.27 views

CVE-2026-67201

CVE-2026-67201 describes a SSRF bypass in V’s standard library between net.urllib and net.http up to version 0.5.2. By crafting a URL with a backslash in the authority section, net.urllib.parse() can extract a trusted host for allowlists, while net.http.get() normalizes the backslash and connects...

8.6CVSS5.9AI score0.00391EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/29 6:12 p.m.35 views

CVE-2026-67201 V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...

8.6CVSS0.00391EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/07/29 6:12 p.m.10 views

CVE-2026-67201

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...

8.6CVSS5.9AI score0.00391EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/07/29 6:12 p.m.17 views

EUVD-2026-50446

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...

8.6CVSS5.9AI score0.00391EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/07/29 6:12 p.m.11 views

CVE-2026-67201 V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...

8.6CVSS5.9AI score0.00391EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/29 6:12 p.m.8 views

CVE-2026-67201 V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...

7.7CVSS5.9AI score
SaveExploits0References7
OSV
OSV
added 2026/07/29 5:37 p.m.8 views

CVE-2026-18236 Google-ADK Continuation Forgery

A vulnerability in the Agent Development Kit ADK allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework di...

10CVSS6AI score
SaveExploits0References3
CVE
CVE
added 2026/07/29 5:37 p.m.69 views

CVE-2026-18236

Technical details are not publicly available in the provided documents. The ADK continuation forgery vulnerability description is repeated across sources without specifics on affected versions, exploit methods, or mitigations. Monitor for updates.

10CVSS6AI score0.00376EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/29 4:24 p.m.19 views

EUVD-2026-43722

Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network...

2.7CVSS5.8AI score0.00311EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/29 4:00 p.m.11 views

GHSA-4P3G-4HCJ-WPVX prebid-server's request forgery vulnerability allows for possible host environment data extraction

Impact Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing...

10CVSS5.9AI score0.00345EPSS
SaveExploits0References5
Rows per page
Query Builder