417 matches found
PT-2026-115277
Name of the Vulnerable Software and Affected Versions JobOps versions prior to 0.13.2 Description A server-side request forgery SSRF issue exists in the 'POST /api/manual-jobs/fetch' endpoint. This allows authenticated users, or unauthenticated clients when the system is in demo mode, to force th...
CVE-2026-55787 Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validateurlssrf and isprivateip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition...
CVE-2026-55787: Server-Side Request Forgery (SSRF)
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validateurlssrf and isprivateip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition...
CVE-2026-110223 Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint
Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects. Attackers can submit a URL to POST /api/Cbl/upload-cbl-file whose host rebinds or redirects to internal addresse...
CVE-2026-57143 PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxngsearch and the searchweb SearxNG provider pass the LLM-controlled searxngurl parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the...
CVE-2026-101029
Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct th...
PT-2026-107130
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Repository migration and pull mirror egress checks can be bypassed using a hostname that returns multiple DNS answers. This occurs because the address validated by the system is not necessarily...
CVE-2026-102150
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...
CVE-2026-102150 Kiteworks Secure Data Forms Missing Authentication for Critical Function
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...
CVE-2026-102150 Kiteworks Secure Data Forms Missing Authentication for Critical Function
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...
EUVD-2026-90386
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...
CVE-2026-102150
A vulnerability exists in the Kiteworks Advanced Forms component where a specific function is reachable without authentication. An unauthenticated attacker could potentially perform a limited set of internal service operations on the Kiteworks platform. However, the vulnerability does not allow a...
CVE-2026-55177
CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...
CVE-2026-102150: Missing Authentication for Critical Function
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...
PT-2026-103582
Name of the Vulnerable Software and Affected Versions Kiteworks affected versions not specified Description A function within the Kiteworks Advanced Forms component is accessible without authentication. This allows an unauthenticated attacker to perform a limited set of internal service operation...
CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope
Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...
CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope
Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...
EUVD-2026-87979
Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...
CVE-2026-101048: Incorrect Authorization
Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...
CVE-2026-100601
The ClawHub (openclaw/clawhub) application/backend is vulnerable to server-side request forgery (SSRF) within the public profile preview's image fetching functionality. The application accepts a user-supplied image URL and validates the textual hostname against private-address patterns but fails ...