102886 matches found
CVE-2026-54885
Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote...
CVE-2026-14980
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled...
Server-side Request Forgery (SSRF)
Overview flyto-core is an A workflow engine with 412 built-in modules. Trace every step. Replay from any point. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the http.get, http.request, and http.batch modules when redirects are followed without per-hop...
Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)
Summary Numerous HTTP-emitting modules core.api.httpget, core.api.httppost, graphql.query/graphql.mutation, monitor.httpcheck, communication.slacksend, notification.discord,slack,teams.sendmessage, ai.visionanalyze anthropic path, verify.visualdiff, browser.proxyrotate, and the agent/llm inline...
Server-side Request Forgery (SSRF)
Overview flyto-core is an A workflow engine with 412 built-in modules. Trace every step. Replay from any point. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the core.api.httpget, core.api.httppost, graphql.query, graphql.mutation, monitor.httpcheck,...
EUVD-2026-50472
Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply SSRF to internal/metadata...
EUVD-2026-50470
Flyto2 Core: Unauthenticated flyto-verification /run: callbackurl SSRF and internal runner-secret exfiltration...
Server-side Request Forgery (SSRF)
Overview flyto-core is an A workflow engine with 412 built-in modules. Trace every step. Replay from any point. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the run process. An attacker can access internal resources and exfiltrate sensitive internal...
Server-side Request Forgery (SSRF)
Overview linuxfabrik-lib is a Python libraries used in various Linuxfabrik projects, including the 'Linuxfabrik Monitoring Plugins' project. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fetch function when credential headers are forwarded across a...
EUVD-2026-51149
Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the issafeurl function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve ...
CVE-2026-67346
Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the issafeurl function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve ...
CVE-2026-67346 Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass
Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the issafeurl function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve ...
CVE-2026-67346
Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the issafeurl function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve ...
CVE-2026-67346
Swarms 6.8.1 is affected by a server-side request forgery in the _is_safe_url function due to hostname validation via DNS resolution. This allows attackers to supply user-controlled image or audio URLs resolving to private, loopback, or metadata addresses to reach internal services and exfiltrate...
CVE-2026-5219
Cross-Site request forgery CSRF vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: before 5.03.01.49...
CVE-2026-54885 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote...
CVE-2026-54885
Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote...
EEF-CVE-2026-54885 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Summary Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch...
CVE-2026-54885 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote...
CVE-2026-54885 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote...