66 matches found
CVE-2023-27163
Request-Baskets рдкрд░ SSRF рдХрд╛ рдкреНрд░реВрдл рдСрдл рдХреЙрдиреНрд╕реЗрдкреНрдЯ CVE-2023-27163 рдЗрд╕ рд░рд┐рдкреЙрдЬрд╝рд┐рдЯрд░реА рдореЗрдВ CVE-2023-27163 рдХреЗ рд▓рд┐рдП рдПрдХ рдкреНрд░реВрдл-рдСрдл-рдХреЙрдиреНрд╕реЗрдкреНрдЯ PoC рд╢рд╛рдорд┐рд▓ рд╣реИ, рдЬреЛ request-baskets рдореЗрдВ рд╕рдВрд╕реНрдХрд░рдг 1.2.1 рддрдХ рдкрд╛рдИ рдЧрдИ рд╕рд░реНрд╡рд░-рд╕рд╛рдЗрдб рд░рд┐рдХреНрд╡реЗрд╕реНрдЯ рдлреЛрд░реНрдЬрд░реА SSRF рднреЗрджреНрдпрддрд╛ рд╣реИред рдпрд╣ рднреЗрджреНрдпрддрд╛ рд╣рдорд▓рд╛рд╡рд░реЛрдВ рдХреЛ рдПрдХ рдХреНрд░рд╛рдлреНрдЯреЗрдб API рдЕрдиреБрд░реЛрдз рдХреЗ рдорд╛рдзреНрдпрдо рд╕реЗ...
CVE-2024-39205-Pyload-RCE
CVE-2024-39205-Pyload-RCE js2py рд╕реИрдВрдбрдмреЙрдХреНрд╕ рдПрд╕реНрдХреЗрдк рдХреЗ рд╕рд╛рде Pyload RCE рд╕рд╛рд░рд╛рдВрд╢ рдХреЛрдИ рднреА pyload-ng рдЬреЛ python3.11 рдпрд╛ рдЙрд╕рд╕реЗ рдиреАрдЪреЗ рдЪрд▓ рд░рд╣рд╛ рд╣реИ, RCE рдХреЗ рдкреНрд░рддрд┐ рд╕рдВрд╡реЗрджрдирд╢реАрд▓ рд╣реИред рд╣рдорд▓рд╛рд╡рд░ рдХреЛрдИ рднреА рд╢реЗрд▓ рдХрдорд╛рдВрдб рдпреБрдХреНрдд рдЕрдиреБрд░реЛрдз рднреЗрдЬ рд╕рдХрддрд╛ рд╣реИ рдФрд░ рдкреАрдбрд╝рд┐рдд рд╕рд░реНрд╡рд░ рддреБрд░рдВрдд рдЙрд╕реЗ рдирд┐рд╖реНрдкрд╛рджрд┐рдд рдХрд░реЗрдЧрд╛ред рд╕рдорд╛рдзрд╛рди pyload-ng рдХреЗ рдирд╡реАрдирддрдо рд╕рдВрд╕реНрдХрд░рдг рдореЗрдВ рдЕрдкрдЧреНрд░реЗрдб рдХрд░...
EUVD-2026-71215
IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1 header, enabling arbitrary writes to IDE config files /.cursor/mcp.json, etc...
martian-packets
рдорд╛рд░реНрдЯрд┐рдпрди рдкреИрдХреЗрдЯреНрд╕ рдПрдХ рд░реЗрдкреЛ рдЬрд┐рд╕рдореЗрдВ рдПрдХ рдкрд╛рдпрдерди рд╕реНрдХреНрд░рд┐рдкреНрдЯ рд╣реИ рдЬрд┐рд╕рдХрд╛ рдЙрдкрдпреЛрдЧ рд░реЙ TCP/IP рдкреИрдХреЗрдЯреНрд╕ рдмрдирд╛рдиреЗ рдХреЗ рд▓рд┐рдП рдХрд┐рдпрд╛ рдЬрд╛ рд╕рдХрддрд╛ рд╣реИред рдХреБрдмреЗрд░рдиреЗрдЯреНрд╕ рдореЗрдВ рдШреЛрд╖рд┐рдд рдПрдХ рдХрдордЬреЛрд░реА kube-proxy: CVE-2020-8558 рдХреЗ рдмрд╛рдж рдорд╛рд░реНрдЯрд┐рдпрди рдкреИрдХреЗрдЯреНрд╕ рдХрд╛ рдкрд░реАрдХреНрд╖рдг рдХрд░рдиреЗ рдХреЗ рд▓рд┐рдП рдЙрдкрдпреЛрдЧ рдХрд┐рдпрд╛ рдЬрд╛рддрд╛ рд╣реИред рдпрд╣ PoC рдкреЙрдб - рдиреЛрдб рд╣реЛрд╕реНрдЯ рд▓реЛрдХрд▓рд╣реЛрд╕реНрдЯ рдмрд╛рдЙрдВрдбреНрд░реА рдмрд╛рдИрдкрд╛рд╕ рдХреЛ рдХрд╡рд░ рдХрд░рдд...
CVE-2026-2020-SSRF-via-URL-Parser-Differential
CVE-2026-2020 тАУ SSRF ╪╣╪и╪▒ ╪з╪о╪к┘Д╪з┘Б ┘Е╪н┘Д┘Д ╪з┘Д╪╣┘Ж╪з┘И┘К┘Ж URL ╪з┘Д┘Г┘И╪п ╪з┘Д╪и╪▒┘Е╪м┘К ╪и╪з┘К╪л┘И┘Ж root@kitploit: vulnerableservice.py - Validates URL with urllib.parse, fetches with requests from flask import Flask, request import requests import urllib.parse app = Flaskname def isallowedurlurl: parsed =...
CVE-2026-9077
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system...
CVE-2026-9077
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system...
CVE-2026-9077
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system...
CVE-2026-9077
Summary of CVE-2026-9077 (IBM Langflow OSS) : Langflow OSS versions 1.0.0тАУ1.10.3 allow remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host. The vulnerability stems from weaknesses in MCP command/...
EUVD-2026-53463
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system...
CVE-2026-70367
A Server-Side Request Forgery SSRF bypass vulnerability exists in тАЬstunnelтАЭ 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., тАЬ::ffff:127.0.0.1тАЭ or unspecified addresses "0.0.0.0", "::"...
CVE-2026-63313
9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...
PT-2026-64185
Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.4.72 Description A server-side request forgery SSRF issue exists in the '/v1/web/fetch' endpoint. The endpoint accepts a user-controlled url parameter and passes it to an external scraping provider to fetch content...
CVE-2026-62312
9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP plugin args passed to childprocess.spawn, allowing...
CVE-2026-62312
CVE-2026-62312 affects 9Router, an AI router & token saver. Before v0.5.2, an authenticated remote attacker can achieve arbitrary code execution on the host by abusing a Host header bypass of localhost-only routes in combination with unvalidated MCP plugin arguments passed to child_process.spawn(...
API Key Bypass
9Router is vulnerable to API key bypass. The vulnerability is due to the router determining whether a /v1 LLM proxy request is local by reading the client-controlled Host header, where a remote unauthenticated attacker can send Host: localhost and bypass API-key authentication, and this allows th...
@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)
Summary A known vulnerability CVE-2026-33060 indicated tools including ckanpackagesearch and sparqlquery that accept a baseurl parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to filter out ip addresses. However, a method to bypass exist...
PYSEC-2026-1822 pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages
Summary Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages. Details Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages. Thi...
PYSEC-2026-499 pyload-ng vulnerable to RCE with js2py sandbox escape
Summary Any pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately. Details js2py has a vulnerability of sandbox escape assigned as CVE-2024-28397, which is used by the...
PYSEC-2026-306 Server-Side Request Forgery in calibreweb
calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery SSRF. This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to localhost...