CVE-2026-33626-Lab

CVE-2026-33626 — LMDeploy 视觉语言 SSRF 实验环境 概述 本仓库重现了 CVE-2026-33626 ，即 LMDeploy 视觉语言图像加载路径中的服务器端请求伪造（SSRF）漏洞。 漏洞行为发生在 LMDeploy 接收图像 URL 时，服务器端图像加载器在不正确阻止内部、私有、回环或链路本地地址的情况下直接获取该 URL。 本实验环境对比： 服务| 版本| 用途 ---|---|--- vuln| LMDeploy 0.12.0| 展示存在漏洞的行为 patched| LMDeploy 0.12.3| 展示修复后的行为 internal| 本地金丝雀服...

Identificador-CVE-2018-11759

其他语言 git - pt-BR 检查你的实例是否暴露了 CVE 2018-11759 文件 main 是一个用于利用漏洞的 bash 脚本。 URL 必须使用协议和完整地址，例如：https://test.site.com.br 如需在一次查询中使用多个 URL，可以使用 here-document，例如： Call the bash, no request permission for exec bash main EOF https://vulpagepagevul.com http://pamonhaemandioca.gov.br https://youtube.com...

CVE-2026-84046

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses...

CVE-2026-84046

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is a failure to validate user-supplied URLs before fetching them server-side, specifically via the Avatar URL f...

EUVD-2026-85034

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses...

CVE-2026-84046: Server-Side Request Forgery (SSRF)

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses...

CVE-2026-92815 changedetection.io through 0.60.6 SSRF via browser-step Goto URL

changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optionalvalue parameter to retrieve responses from restricted network locations...

CVE-2026-92815 changedetection.io through 0.60.6 SSRF via browser-step Goto URL

changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optionalvalue parameter to retrieve responses from restricted network locations...

CVE-2026-92815

changedetection.io through 0.60.6 is vulnerable to an unauthenticated SSRF via the browser-step Goto URL action. The root cause is that the SSRF guard is only applied to the main watch URL and is bypassed in browser step Goto URLs, allowing attackers to supply arbitrary internal URLs in the optio...

CVE-2026-92568

MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows authenticated users to make the API server send arbitrary HTTP requests to internal addresses. Attackers can update a run with a malicious webhook notification that executes wh...

CVE-2026-92568 MLRun through 1.11.0 Server-Side Request Forgery via Webhook

MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows authenticated users to make the API server send arbitrary HTTP requests to internal addresses. Attackers can update a run with a malicious webhook notification that executes wh...

CVE-2026-92804: Server-Side Request Forgery (SSRF)

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potential...

CVE-2026-57126 praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools.validateurl calls hostisblocked, which checks literal host encodings but does not resolve DNS names before scrapepage, crawl, extractlinks, extracttext, or URL-mention fetches connect. An attacker-controlled...

CVE-2026-82757

Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the...

EUVD-2026-72539

Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the...

EUVD-2026-71721

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...

CVE-2026-85666 ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url

OGX formerly Llama Stack, affected at commit fbe8e0f contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a serverurl parameter along with headers and authorization values that is fetched server-sid...

CVE-2026-85172

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present,...

CVE-2026-85172: Server-Side Request Forgery (SSRF)

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present,...

CVE-2026-82268

Qwen-Agent through 0.0.34 contains a server-side request forgery (SSRF) vulnerability in its document parsing path (qwen_agent/tools/simple_doc_parser.py). Caller-supplied paths are treated as URLs without scheme restriction or host validation , allowing an unauthenticated attacker to reach the G...