Lucene search
+L

159 matches found

Positive Technologies
Positive Technologies
•added 2026/03/20 12:00 a.m.•11 views

PT-2026-26650

CVE-2026-30580 File Thingie 2.5.7 is vulnerable to Directory Traversal. A malicious user can leverage the "create folder from url" functionality of the application to read arbitrary… https://t.co/olkBtQ0mG8...

5.8AI score0.00636EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
•added 2026/03/20 12:00 a.m.•5 views

CVE-2026-30580

File Thingie 2.5.7 is vulnerable to Directory Traversal. A malicious user can leverage the "create folder from url" functionality of the application to read arbitrary files on the target system...

5.9AI score0.00636EPSS
SaveExploits0References2
NVD
NVD
•added 2026/03/17 6:16 p.m.•14 views

CVE-2026-25534

Impact Spinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver. However, they missed that Java URL objects do not correctly handle underscores on parsing. This led to a bypass of the previous CVE CVE-2025-61916 through the use of carefully...

9.1CVSS0.00405EPSS
SaveExploits0References3
NVD
NVD
•added 2026/03/09 9:16 p.m.•25 views

CVE-2026-25960

vLLM is an inference and serving engine for large language models LLMs. The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the loadfromurlasync method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. The SSRF fix uses...

9.8CVSS0.00718EPSS
SaveExploits1References9
Github Security Blog
Github Security Blog
•added 2026/03/09 7:55 p.m.•25 views

vLLM has SSRF Protection Bypass

Summary The SSRF protection fix for https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc can be bypassed in the loadfromurlasync method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. Affected Component - File:...

9.8CVSS5.9AI score0.00718EPSS
SaveExploits1References13Affected Software1
OSV
OSV
•added 2026/01/28 4:14 p.m.•8 views

GHSA-QH4C-XF7M-GXFC vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector

Summary A Server-Side Request Forgery SSRF vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The loadfromurl and loadfromurlasync methods obtain and process media from URLs provided by users, using different Python parsing libraries when restrictin...

7.1CVSS6.1AI score0.00718EPSS
SaveExploits2References20
EUVD
EUVD
•added 2026/01/28 5:30 a.m.•14 views

EUVD-2026-4865

The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the imagereplacementfromurl function that is hooked to the erifromurl AJAX action. This makes it possible for authenticated...

5.3CVSS5.9AI score0.00264EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/01/28 12:00 a.m.•43 views

PT-2026-5061

The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the image replacement from url function that is hooked to the eri from url AJAX action. This makes it possible for...

5.3CVSS5.9AI score0.00264EPSS
SaveExploits0References5
NVD
NVD
•added 2026/01/27 10:15 p.m.•18 views

CVE-2026-24779

vLLM is an inference and serving engine for large language models LLMs. Prior to version 0.14.1, a Server-Side Request Forgery SSRF vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The loadfromurl and loadfromurlasync methods obtain and process...

7.1CVSS0.00588EPSS
SaveExploits1References15
OSV
OSV
•added 2026/01/22 6:16 p.m.•20 views

CVE-2025-56590

An issue was discovered in the InsertFromURL function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could allow an attacker to execute arbitrary operating system commands on the local server...

9.8CVSS6AI score0.00543EPSS
SaveExploits1References2
attackerkb
attackerkb
•added 2026/01/22 12:00 a.m.•8 views

CVE-2025-56590

An issue was discovered in the InsertFromURL function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could allow an attacker to execute arbitrary operating system commands on the local server...

9.8CVSS5.9AI score0.00543EPSS
SaveExploits1References3
Positive Technologies
Positive Technologies
•added 2026/01/22 12:00 a.m.•28 views

PT-2026-3990

Name of the Vulnerable Software and Affected Versions Apryse HTML2PDF SDK versions through 11.10 Description A flaw exists in the InsertFromURL function that may allow an attacker to execute arbitrary operating system commands on the local server. Recommendations Update to a version beyond 11.10...

9.8CVSS5.8AI score0.00543EPSS
SaveExploits1References6
RedhatCVE
RedhatCVE
•added 2026/01/09 11:27 a.m.•16 views

CVE-2021-33213

An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address...

6.5CVSS6.6AI score0.01304EPSS
SaveExploits1References1
Veracode
Veracode
•added 2025/11/24 3:37 p.m.•17 views

Server-Side Request Forgery (SSRF)

vllm is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient restrictions on user-supplied URLs in the MediaConnector class’s loadfromurl and loadfromurlasync methods, which allows an attacker to coerce the server into making arbitrary internal network requests...

7.1CVSS7.2AI score0.00247EPSS
SaveExploits0References6Affected Software1
Circl
Circl
•added 2025/11/21 10:23 p.m.•4 views

GHSA-6XVF-4VH9-MW47

creationtimestamp| type| source ---|---|--- 2025-11-21 22:23:21+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115590024467115020...

5.8AI score
SaveExploits0References1
NVD
NVD
•added 2025/11/18 3:16 p.m.•13 views

CVE-2025-63883

A DOM-based cross-site scripting vulnerability exists in electic-shop v1.0 Bhabishya-123/E-commerce. The site's client-side JavaScript reads attacker-controlled input for example, values derived from the URL or page fragment and inserts it into the DOM via unsafe sinks...

5.4CVSS0.00252EPSS
SaveExploits1References1
Cvelist
Cvelist
•added 2025/11/18 1:56 p.m.•21 views

CVE-2025-55179

Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen...

5.4CVSS0.0017EPSS
SaveExploits0References2
NVD
NVD
•added 2025/11/04 10:16 p.m.•13 views

CVE-2025-62719

LinkAce is a self-hosted archive to collect website links. In versions 2.3.0 and below, the htmlKeywordsFromUrl function in the FetchController class accepts user-provided URLs and makes HTTP requests to them without validating that the destination is not an internal or private network resource...

4.3CVSS0.00311EPSS
SaveExploits1References3
Snyk
Snyk
•added 2025/10/07 10:14 p.m.•16 views

Server-side Request Forgery (SSRF)

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the loadfromurl and loadfromurlasync methods of the MediaConnector class, which fetch and process media from...

8.3CVSS7.1AI score0.00247EPSS
SaveExploits0References3
OSV
OSV
•added 2025/10/07 10:14 p.m.•13 views

GHSA-3F6C-7FW2-PPM4 vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class

Summary A Server-Side Request Forgery SSRF vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The loadfromurl and loadfromurlasync methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows...

7.1CVSS6.5AI score0.00247EPSS
SaveExploits0References6
Rows per page
Query Builder