CVE-2026-42345

FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress function in packages/service/common/system/utils.ts blocks cloud metadata endpoints using a fullUrl.startsWith check against a hardcoded list. This check can be bypassed using at least 7 different...

CVE-2026-42345 FastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, and trailing dot

FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress function in packages/service/common/system/utils.ts blocks cloud metadata endpoints using a fullUrl.startsWith check against a hardcoded list. This check can be bypassed using at least 7 different...

CVE-2026-42345 FastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, and trailing dot

FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress function in packages/service/common/system/utils.ts blocks cloud metadata endpoints using a fullUrl.startsWith check against a hardcoded list. This check can be bypassed using at least 7 different...

EUVD-2026-28855

FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress function in packages/service/common/system/utils.ts blocks cloud metadata endpoints using a fullUrl.startsWith check against a hardcoded list. This check can be bypassed using at least 7 different...

CVE-2026-42345 FastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, and trailing dot

FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress function in packages/service/common/system/utils.ts blocks cloud metadata endpoints using a fullUrl.startsWith check against a hardcoded list. This check can be bypassed using at least 7 different...

CVE-2026-42345

FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress function in packages/service/common/system/utils.ts blocks cloud metadata endpoints using a fullUrl.startsWith check against a hardcoded list. This check can be bypassed using at least 7 different...

CVE-2026-42345

FastGPT (version 4.14.11 and earlier) exposes an SSRF risk in isInternalAddress() (packages/service/common/system/utils.ts) where a fullUrl.startsWith() hardcoded blocklist can be bypassed by at least 7 URL-encoding techniques that resolve to the cloud metadata endpoint. The broader private IP ch...

wagtail-metadata-mixin (0.0.7), wagtailperson (0.9.8) potentially affected by CVE-2026-44200 via wagtail (2.8.0)

wagtail PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-metadata-mixin 0.0.7 - wagtailperson 0.9.8 Source cves: CVE-2026-44200 Source advisory: OSV:GHSA-67RV-MG8Q-5PF3...

coderedcms (>=0.15.0, <=0.15.2), coop (2.5.0) +7 more potentially affected by CVE-2026-44200 via wagtail (2.5.2)

wagtail PYPI version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms =0.15.0, =0.0.3, =0.7.0rc2, =0.16.5, =0.20.1 - wagtail-textract 1.2.0.dev0 - wagtail-treemodeladmin 1.0.5 Source cves: CVE-2026-44200...

wagtail-metadata-mixin (0.0.7), wagtailperson (0.9.8) potentially affected by CVE-2026-44201 via wagtail (2.8.0)

wagtail PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-metadata-mixin 0.0.7 - wagtailperson 0.9.8 Source cves: CVE-2026-44201 Source advisory: OSV:GHSA-P5GM-92H4-6PV6...

wagtail-metadata-mixin (0.0.7), wagtailperson (0.9.8) potentially affected by CVE-2026-44199 via wagtail (2.8.0)

wagtail PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-metadata-mixin 0.0.7 - wagtailperson 0.9.8 Source cves: CVE-2026-44199 Source advisory: OSV:GHSA-PWM3-7FV4-G6XX...

wagtail-metadata-mixin (0.0.7), wagtailperson (0.9.8) potentially affected by CVE-2026-44198 via wagtail (2.8.0)

wagtail PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-metadata-mixin 0.0.7 - wagtailperson 0.9.8 Source cves: CVE-2026-44198 Source advisory: OSV:GHSA-C4MR-889M-VGF6...

wagtail-metadata-mixin (0.0.7), wagtailperson (0.9.8) potentially affected by CVE-2026-44197 via wagtail (2.8.0)

wagtail PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-metadata-mixin 0.0.7 - wagtailperson 0.9.8 Source cves: CVE-2026-44197 Source advisory: OSV:GHSA-C6WJ-9VCJ-75PJ...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization via the validatecollectionaccess function. An attacker can obtain sensitive metadata, such as IDs, names, and descriptions of all knowledge bases across users, by sending crafted API...

CVE-2026-42181

Lemmy prior to 0.19.18 is vulnerable to SSRF through post link metadata: the system validates the top-level URL against internal ranges, but the og:image URL extracted from the page is not subjected to the same restriction. An authenticated low-privileged user can post a page whose og:image point...

CVE-2026-42181 Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP...

GHSA-CMRH-WVQ6-WM9R n8n-mcp webhook and API client paths has an authenticated SSRF

Summary Authenticated Server-Side Request Forgery affecting the webhook trigger tools, the n8n API client N8NAPIURL, and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. Impact A caller with access to the MCP session can drive HTTP requests from the n8n-mcp host to...

EUVD-2026-28631

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region We observe spurious "Synchronous External Abort" exceptions ESR=0x96000010 and kernel crashes on Monaco-based platforms. These faults are caused by the kernel...

EUVD-2026-28579

In the Linux kernel, the following vulnerability has been resolved: md raid: fix hang when stopping arrays with metadata through dm-raid When using device-mapper's dm-raid target, stopping a RAID array can cause the system to hang under specific conditions. This occurs when: - A dm-raid managed...

CVE-2026-43420

In the Linux kernel, the following vulnerability has been resolved: ceph: fix inlink underrun during async unlink During async unlink, we drop the inlink counter before we receive the completion that will eventually update the inlink because "we assume that the unlink will succeed". That is not a...