Lucene search
+L

12080 matches found

Cvelist
Cvelist
added 2026/08/24 10:29 a.m.4 views

CVE-2026-10582 Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

8.3CVSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/24 12:30 a.m.6 views

EUVD-2026-64680

BentoML's outbound connection safeguard makesafeconnect in internal/utils/uri.py blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space 100.64.0.0/10, CGNAT. In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointin...

6.9CVSS5.5AI score
SaveExploits0References4
GithubExploit
GithubExploit
added 2026/08/23 2:23 p.m.17 views

vuln-labs-angara

vuln-labs-angara Семь независимых Docker-стендов с уязвимыми...

9.9CVSS7.8AI score0.0125EPSS
SaveExploits2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.126 views

perfSONAR 4.x <= 4.4.4 - Server-Side Request Forgery

An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Request Forgery SSRF attacks. id: CVE-2022-41412 info: name: perfSONAR 4.x = 4.4.4 - Server-Side Request Forgery author: nullhypothesis severity: high descriptio...

8.6CVSS8.2AI score0.04088EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.128 views

Alibaba Sentinel - Server-side request forgery (SSRF)

There is a Pre-Auth SSRF vulnerability in Alibaba Sentinel version 1.8.2, which allows remote unauthenticated attackers to perform SSRF attacks via the /registry/machine endpoint through the ip parameter. id: CVE-2021-44139 info: name: Alibaba Sentinel - Server-side request forgery SSRF author:...

7.5CVSS7.6AI score0.05643EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.55 views

Geoserver - Server-Side Request Forgery

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows server-side request forgery via the option for setting a proxy host. id: CVE-2021-40822 info: name: Geoserver - Server-Side Request Forgery author: For3stCo1d,aringo-bf severity: high description: GeoServer through 2.18.5 and 2.19.x throug...

7.5CVSS7.4AI score0.19259EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.69 views

Canvas LMS v2020-07-29 - Blind Server-Side Request Forgery

Canvas version 2020-07-29 is susceptible to blind server-side request forgery. An attacker can cause Canvas to perform HTTP GET requests to arbitrary domains and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-5775 info: name: Canva...

5.8CVSS6.2AI score0.06531EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.305 views

ChatGPT个人专用版 - Server Side Request Forgery

A Server-Side Request Forgery SSRF in pictureproxy.php of ChatGPT commit f9f4bbc allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the urlparameter. id: CVE-2024-27564 info: name: ChatGPT个人专用版 - Server Side Request Forgery author: DhiyaneshDK...

6.5CVSS7.6AI score0.40637EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.86 views

HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11 are susceptible to server-side request forgery. When redirects are returned by HTTP health check endpoints, Consul follows these HTTP redirects by default. An attacker can possibly obtain sensitive information, modify data,...

7.5CVSS6.9AI score0.08676EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.75 views

Drawio <18.1.2 - Server-Side Request Forgery

Drawio before 18.1.2 is susceptible to server-side request forgery via the /service endpoint in jgraph/drawio. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-1815 info: nam...

7.5CVSS6.2AI score0.05389EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.85 views

Flyte Console <0.52.0 - Server-Side Request Forgery

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or...

9.1CVSS7.5AI score0.10479EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.168 views

DotNetNuke (DNN) ImageHandler <9.2.0 - Server-Side Request Forgery

DotNetNuke aka DNN before 9.2.0 suffers from a server-side request forgery vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources. id: CVE-2017-0929 info: name: DotNetNuke DNN ImageHandler 9.2.0 - Server-Side Request Forgery author...

7.5CVSS7.8AI score0.09157EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.62 views

Netmask NPM Package - Server-Side Request Forgery

Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the...

9.1CVSS7.1AI score0.16657EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.121 views

MeterSphere < 2.5.0 SSRF

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in...

7.2CVSS6AI score0.01607EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.84 views

Apache HTTPd Windows UNC - Server-Side Request Forgery

SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note- Existing configurations that access UNC paths will have to configure new...

7.5CVSS6.2AI score0.6947EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.47 views

Graphite <=1.1.5 - Server-Side Request Forgery

Graphite's sendemail in graphite-web/webapp/graphite/composer/views.py in versions up to 1.1.5 is vulnerable to server-side request forgery SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is...

7.5CVSS6.6AI score0.15301EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.6 views

Gotenberg <= 8.30.1 - Server Side Request Forgery

Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression ^https?:// to match URL schemes. Because Go's net/url.Parse normalizes...

7.8CVSS8.6AI score0.01491EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.65 views

GitLab Enterprise Edition - Server-Side Request Forgery

An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The Jira integration feature is vulnerable to an unauthenticated blind SSRF issue. id: CVE-2019-6793 info: name: GitLab Enterprise Edition - Server-Side Request Forgery author:...

7CVSS7.2AI score0.03506EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.72 views

WordPress Like Button Rating <2.6.32 - Server-Side Request Forgery

WordPress Like Button Rating plugin before 2.6.32 is susceptible to server-side request forgery. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2021-24150 info: name: WordPress Like Button Rating 2.6.32 - Server-Side Request Forgery...

7.5CVSS7.5AI score0.04337EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.121 views

MinIO Browser API - Server-Side Request Forgery

MinIO Browser API before version RELEASE.2021-01-30T00-20-58Z contains a server-side request forgery vulnerability. id: CVE-2021-21287 info: name: MinIO Browser API - Server-Side Request Forgery author: pikpikcu severity: high description: MinIO Browser API before version...

7.7CVSS7.5AI score0.24784EPSS
SaveExploits0References5
Rows per page
Query Builder