CVE-2026-111418

A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service . The root cause is that the service supports ZIP-formatted input , which can be used to bypass restrictions on requests to internal IP addresses. This could potentially allow ...

Server-Side Request Forgery (SSRF)

A2A Java SDK is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of push notification destination URLs and unrestricted redirect handling, which allows an unauthenticated attacker to make the server send HTTP requests to internal or restricted...

Server-Side Request Forgery

Apache Camel is vulnerable to Server-Side Request Forgery. The vulnerability is due to the AS2 component taking the MDN destination address from the inbound message without validation, where it uses that address as the destination for the outgoing receipt and a remote partner can supply an...

Server-side Request Forgery (SSRF)

Overview Crawl4AI is a 🚀🤖 Crawl4AI: Open-source LLM Friendly Web Crawler & scraper Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the SSLCertificate.fromurl process. An attacker can access internal network resources and obtain SSL certificate information ...

Linux Distros Unpatched Vulnerability : CVE-2026-100104

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain...

BIT-GITLAB-2026-100104 Server-Side Request Forgery (SSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

PT-2026-115850

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

CVE-2026-100104

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

UBUNTU-CVE-2026-100104

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

CVE-2026-100104

GitLab CE/EE versions 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are vulnerable to a Server-Side Request Forgery (SSRF) . The flaw is caused by a time-of-check to time-of-use race condition during URL validation while performing repository import operations . This could allow ...

CVE-2026-100104 Server-Side Request Forgery (SSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

CVE-2026-100104 Server-Side Request Forgery (SSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

CVE-2026-100104: Server-Side Request Forgery (SSRF)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the ffrtspconnect function in libavformat/rtsp.c when RTSP 3xx redirects are followed without validating the Location URL. An attacker can access internal network resources by hosting a malicious RTSP...

Server-side Request Forgery (SSRF)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the IP address validation logic in request-external.js, which fails to correctly classify certain IPv6 transition addresses IPv4-compatible ::/96, IPv4-mapped...

CVE-2026-106557

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDo...

GHSA-F7V3-XHM6-W245 Backstage has improper input validation in TechDocs Markdown extension configuration

Impact An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary. Depending on deployment configuration, this may expose sensitive backend-host data or internal network resources. Patches Patch...

CVE-2026-106557 Backstage: Improper input validation in TechDocs Markdown extension configuration

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDo...

CVE-2026-106557

The Backstage framework (versions prior to 1.14.6 and 1.15.4 ) is vulnerable to improper input validation within the @backstage/plugin-techdocs-node package. An authenticated user capable of registering or modifying documentation sources can trigger a TechDocs build that accesses resources outsid...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the WebfingerService process. An attacker can access internal network resources and probe internal HTTPS services and ports by submitting a crafted actorhandle parameter containing a numeric host and...