Lucene search
+L

57475 matches found

Vulnrichment
Vulnrichment
added 2026/07/15 2:37 p.m.11 views

CVE-2026-54562 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or...

6.5CVSS6.2AI score0.00402EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/15 2:32 p.m.11 views

CVE-2026-61646

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta5, FastGPT's shared SSRF guard validates only the initial request URL before handing the request to axios, and axios follows redirects by default. An authenticated workflow user can configure an HTTP request node to call an...

6.3CVSS6.1AI score0.00364EPSS
SaveExploits0References3Affected Software1
CVE
CVE
added 2026/07/15 2:16 p.m.52 views

CVE-2026-61835

Product : Directus (real-time API and app dashboard for SQL databases). Vulnerability : SSRF protection bypass in the file-import-from-URL feature prior to 12.0.0. The denial logic treats 0.0.0.0 as local, but does not block the literal address, allowing an authenticated user with file-upload rig...

7.7CVSS6.1AI score0.00407EPSS
SaveExploits0References4Affected Software1
NVD
NVD
added 2026/07/15 12:18 p.m.16 views

CVE-2026-61430

PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the webcrawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies...

8.5CVSS0.00348EPSS
SaveExploits0References2
Veracode
Veracode
added 2026/07/15 11:15 a.m.14 views

Server-Side Request Forgery (SSRF)

kLOsk adloop is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of the finalurl parameter in the validateurls function, where attacker-controlled URLs are processed without adequate restrictions, allowing attackers to make server-side requests t...

6.5CVSS6.7AI score0.00374EPSS
SaveExploits0References8Affected Software1
RedHat Linux
RedHat Linux
added 2026/07/15 10:00 a.m.7 views

Important: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-glance) security update

An update for openstack-glance is now available for Red Hat OpenStack Services on OpenShift 18.0 Antelope. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

7.1CVSS6.1AI score0.00271EPSS
SaveExploits1References4
RedHat Linux
RedHat Linux
added 2026/07/15 10:00 a.m.6 views

openstack-glance: OpenStack Glance: Server-Side Request Forgery leading to unauthorized internal network access

A flaw was found in OpenStack Glance. An authenticated user can exploit a Server-Side Request Forgery SSRF vulnerability within the web-download import feature. This vulnerability stems from inadequate validation of Uniform Resource Identifiers URIs, which can be circumvented using HTTP redirects...

7.1CVSS6AI score0.00271EPSS
SaveExploits1References5
NVD
NVD
added 2026/07/15 8:16 a.m.22 views

CVE-2026-15583

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud...

8.6CVSS0.00529EPSS
SaveExploits1References1
Microsoft CVE
Microsoft CVE
added 2026/07/15 8:03 a.m.15 views

RabbitMQ: UNC SSRF affecting the management UI on Windows

...

10CVSS5.2AI score0.00631EPSS
SaveExploits1
Vulnrichment
Vulnrichment
added 2026/07/15 7:29 a.m.22 views

CVE-2026-15583 SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud...

8.6CVSS6.2AI score0.00529EPSS
SaveExploits1References1
ATTACKERKB
ATTACKERKB
added 2026/07/15 7:29 a.m.15 views

CVE-2026-15583

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud...

8.6CVSS6.2AI score0.00529EPSS
SaveExploits1References2
SUSE CVE
SUSE CVE
added 2026/07/15 5:35 a.m.12 views

SUSE CVE-2026-15146

GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget's data connection to an arbitrary IP address and port. This allows an...

5.9CVSS5.5AI score0.00164EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/07/15 12:31 a.m.30 views

EUVD-2026-44527

CAI Content Credentials is affected by a Server-Side Request Forgery SSRF vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access o...

8.2CVSS6.4AI score0.00295EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/15 12:00 a.m.25 views

PT-2026-60194

Name of the Vulnerable Software and Affected Versions Directus versions prior to 12.0.0 Description An authenticated user with file-upload permissions can bypass Server-Side Request Forgery SSRF protections—a flaw where a server is tricked into making requests to an unintended location—via the...

7.7CVSS5.2AI score0.00407EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/07/15 12:00 a.m.31 views

PT-2026-60233

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.1 Splunk Enterprise versions prior to 10.2.5 Splunk Enterprise versions prior to 10.0.8 Splunk Enterprise versions prior to 9.4.13 Splunk Cloud Platform versions prior to 10.5.2605.0 Splunk Cloud Platfo...

8.3CVSS6.2AI score0.00182EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/07/15 12:00 a.m.24 views

PT-2026-60385

Name of the Vulnerable Software and Affected Versions Koel versions prior to 9.7.0 Description An authenticated user can perform a Server-Side Request Forgery SSRF via Subsonic-compatible endpoints. The createInternetRadioStation.view and updateInternetRadioStation.view routes fail to implement t...

7.7CVSS5.2AI score0.00264EPSS
SaveExploits0References10
CVE
CVE
added 2026/07/14 9:33 p.m.41 views

CVE-2026-48290

CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary code execution in the context of the current user. An attacker could exploit this to inject malicious scripts into a web page and potentially gain elevated access or control over...

8.2CVSS6.4AI score0.00295EPSS
SaveExploits0References1Affected Software3
ATTACKERKB
ATTACKERKB
added 2026/07/14 9:33 p.m.10 views

CVE-2026-48290

CAI Content Credentials is affected by a Server-Side Request Forgery SSRF vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access o...

8.2CVSS6.4AI score0.00295EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/14 9:04 p.m.16 views

CVE-2026-48332

ColdFusion is affected by a Server-Side Request Forgery SSRF vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user...

7.7CVSS6.1AI score0.00716EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/14 9:04 p.m.201 views

CVE-2026-48332 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)

ColdFusion is affected by a Server-Side Request Forgery SSRF vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user...

7.7CVSS0.00716EPSS
SaveExploits0References1
Rows per page
Query Builder