EUVD-2026-114117

PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser.fetchsingleurl that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web...

EUVD-2026-114114

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...

shootback

shootback shootback is a reverse TCP tunnel let you access target behind NAT or firewall 反向TCP隧道, 使得NAT或防火墙后的内网机器可以被外网访问. Consumes less than 1% CPU and 8MB memory under 800 concurrency. slaver is single file and only depends on python2.7/3.4+ standard library. How it works Typical Scene 1. Access...

npcap

Npcap Npcap is a packet capture and injection library for Windows by the Nmap Project. It is a complete update to the unmaintained WinPcap project with improved speed, reliability, and security. Documentation The complete documentation for Npcap is available in the Npcap Guide on npcap.com. There...

Imgproxy < 3.27.2 - Server-Side Request Forgery (SSRF)

imgproxy contains an issue caused by not blocking the 0.0.0.0 address even when IMGPROXYALLOWLOOPBACKSOURCEADDRESSES is set to false, letting local services be exposed, exploit requires network access. id: CVE-2025-24354 info: name: Imgproxy 3.27.2 - Server-Side Request Forgery SSRF author:...

ida-pro-mcp

IDA Pro MCP ⚠️ Archived — superseded by the official Hex-Rays IDA MCP server This project is no longer maintained. On 2026-09-27 Hex-Rays SA released the Official IDA MCP Server and IDA Nexus. Development stopped the same day at 1.0.0a4. For current use, install theirs: uvx ida-hcli mcp install. I...

CVE-2026-33534

CVE-2026-33534 - EspoCRM 9.3.3 Authenticated SSRF Authenticated SSRF proof-of-concept for EspoCRM 9.3.3 via alternative IPv4 loopback notation in the /api/v1/Attachment/fromImageUrl endpoint. Summary EspoCRM 9.3.3 blocks direct loopback URLs such as http://127.0.0.1/..., but the server-side fetch...

gitlab-gitea-import-ssrf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · gitlab-gitea-import-ssrf Write-up: https://abraxaslabs.tech/research/gitlab-gitea-import-ssrf gitlab-gitea-import-ssrf GitLab CE 19.4.1 - GitLab Inc. Gitea import calls UrlBlocker.validate! once, then for https throws...

CVE-2026-118425

A flaw exists in the secure-redirect-uris-enforcer client policy of Keycloak , an identity and access management solution. The vulnerability arises when the policy is configured to allow loopback addresses because Keycloak performs DNS resolution during hostname validation. An attacker can bypass...

EUVD-2026-112916

A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlis...

CVE-2026-116678

A flaw was found in Vaultwarden. When internal icon downloading is enabled, the server fails to properly validate secondary favicon web addresses extracted from untrusted pages against network access restrictions. A remote, unauthenticated attacker can exploit this vulnerability to cause...

CVE-2026-51585

realtek poc rt26cx21x64.sys exploit Realtek PCIe GbE/2.5GbE/5GbE family Overview OID 0xFF816871 maps the nic's mmio bar into the calling proc's virtual addr space, MmLockedPagesSpecifyCache, reachable from um via \.\RealTekCardGUID This IOCTL 0x0012C818 is gated by a registry value DrvMode=4 Once...

CVE-2026-72018

CVE-2026-72018 — Linux Kernel Out-of-Bounds Write Linux Kernel • DIBS Loopback • Out-of-Bounds Write Security research and technical analysis of CVE-2026-72018. 01 — Overview CVE-2026-72018 is a Linux kernel out-of-bounds write vulnerability affecting the DIBS/ISM loopback functionality. The...

npm: mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6

npm: mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 vulnerability discovered by ? in WordPress npm mcp-sanitizer versions 1.4.0...

CVE-2026-115495

Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password...

CVE-2026-115495

The WatchGuard Mobile VPN with SSL client for Windows is vulnerable to a Cleartext Transmission of Sensitive Information flaw (CWE-319). A local attacker capable of capturing loopback traffic can intercept the communication over the local management socket to obtain a user's VPN username and pass...

GHSA-JJ7H-C3HG-M23X Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

Summary authlib.common.security.issecuretransport is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback http:// URIs. The check is implemented as a textual str.startswith prefix match, so a URL...

CVE-2026-117604 Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback

Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized that allows unauthenticated visitors to read /clockwork/ profiler data via a loopback REMOTEADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting...

CVE-2026-117604

The Grav CMS (versions 1.7.53.3 before 1.7.53.6 ) is vulnerable to an authorization bypass in the Debugger::isDebuggerRequestAuthorized() function. This flaw allows unauthenticated visitors to access /__clockwork/ profiler data by exploiting a loopback REMOTE_ADDR fallback . When deployed behind ...

CVE-2026-117604 Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback

Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized that allows unauthenticated visitors to read /clockwork/ profiler data via a loopback REMOTEADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting...