101612 matches found
XStream <1.4.15 - Server-Side Request Forgery
XStream before 1.4.15 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorize...
CVE-2026-87953 SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151
Server-Side Request Forgery SSRF vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...
CVE-2026-87953 SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151
Server-Side Request Forgery SSRF vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...
CVE-2026-87953
The Drupal SAML SSO - Service Provider module versions 0.0.0 through 3.2.0 is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is the module's failure to sufficiently validate URLs obtained from identity provider metadata . An attacker who has the permissions required to config...
CVE-2026-96370 Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164
Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
EUVD-2026-107837
Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
CVE-2026-96370 Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164
Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
CVE-2026-96370
The Drupal Webform module is vulnerable to Server-Side Request Forgery (SSRF) due to an incorrect authorization issue in the Webform Submission Export/Import submodule. The submodule fails to sufficiently validate access to its export and import functionality. An attacker with permissions to edit...
CVE-2026-96374 Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178
Cross-Site Request Forgery CSRF vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5...
CVE-2026-96374
The Project Browser module for Drupal is vulnerable to a Cross-Site Request Forgery (CSRF) issue. The module fails to sufficiently validate administrative actions, which could allow an attacker to perform unauthorized actions such as applying recipes or enabling modules via the web user interface...
CVE-2026-96374 Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178
Cross-Site Request Forgery CSRF vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5...
EUVD-2026-107823
Cross-Site Request Forgery CSRF vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5...
CVE-2026-96388 Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184
Cross-Site Request Forgery CSRF vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4...
Linux Distros Unpatched Vulnerability : CVE-2026-114730
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by...
CVE-2026-114374 leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadataapi.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The...
CVE-2026-114374
The leomoon-studios wiki-go software, versions up to 1.9.1 , is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The flaw exists within an unknown function in the internal/handlers/metadata_api.go file, specifically affecting the fetch-metadata Endpoint component. An attacker can...
CVE-2026-114362 HarnessRouter Targets Test Endpoint app.py server-side request forgery
A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument baseurl can lead to server-side request forgery. The attack may be performed from remote. Upgrading to...
CVE-2026-114362
The HarnessRouter software (versions up to 0.31.12 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the Targets Test Endpoint component. Specifically, a flaw in an unknown function of the gateway/app.py file allows an attacker to perform a remote manipulation of the base_url a...
CVE-2026-114493
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those...