CVE-2026-51385

CVE-2026-51385 Aviso para CVE-2026-51385. Necesario publicarlo ya que GRAPHIFY no ha reconocido el aviso ni lo ha publicado, y MITRE asignó CVE-2026-51385, este es el aviso correspondiente. ES: Este fue mi primer cve, para ser honesto encontre una manera de romper la logica en la funcion ANTI SSR...

CVE-2026-19953

A flaw was found in the URI component for Perl. This vulnerability occurs because the nameprep function, responsible for encoding hostnames, does not properly normalize Unicode characters. As a result, a hostname that is not in a standard Unicode form non-NFC can be encoded into a non-standard...

fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2022_1935)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221935 advisory. php: Local privilege escalation via PHP-FPM CVE-2021-21703 php: SSRF bypass in FILTERVALIDATEURL CVE-2021-21705 Tenable has extracted the preceding...

EUVD-2026-70282

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority...

Improper Validation of Specified Type of Input

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via isHostInSubnet and isInSubnet which delegates to it, which compares masked binary strings...

EUVD-2026-87475

OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reaching blocked destinations. Attackers can use the wait --fn function against an existing browser session to request loopback or...

CVE-2026-77274 MCP Atlassian: SSRF Protection Bypass

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validateurlforssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL...

CVE-2026-61743

Chartbrew , an open-source web application for generating charts from databases and APIs, is affected by a DNS rebinding SSRF bypass prior to version 5.2.2 . The root cause is a time-of-check-time-of-use (TOCTOU) flaw: server/modules/safeRequest.js calls validateOutboundUrl() to resolve and valid...

GHSA-39WR-7Q6H-CF68 LMDeploy has an SSRF bypass

Summary The URL checking logic in lmdeploy has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. Details The current lmdeploy project uses issafeurl to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by...

EulerOS Virtualization 2.11.1 : python-pip (EulerOS-SA-2026-3464)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third...

EulerOS Virtualization 2.11.1 : python-urllib3 (EulerOS-SA-2026-3468)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all...

Fedora 43 : roundcubemail (2026-821349f438)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-821349f438 advisory. Release 1.6.19 - Fix PHP Warning: Undefined variable $tmpcommand in .../plugins/markasjunk/drivers/cmdlearn.php 10294 - Security: Fix CSS declaration smuggli...

CVE-2026-18424 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A...

CVE-2026-54689 mcp-searxng hardened-mode SSRF bypasses permit internal URL access

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the weburlread URL policy in src/url-reader.ts can be bypassed while MCPHTTPHARDEN is enabled and MCPHTTPALLOWPRIVATEURLS is not enabled because redirec...

CVE-2026-54689 mcp-searxng hardened-mode SSRF bypasses permit internal URL access

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the weburlread URL policy in src/url-reader.ts can be bypassed while MCPHTTPHARDEN is enabled and MCPHTTPALLOWPRIVATEURLS is not enabled because redirec...

CVE-2026-77866 SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts

Server-Side Request Forgery SSRF vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block. Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is treated a...

CVE-2026-91938 Flowise before 3.1.4 Server-Side Request Forgery via document loaders

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...

CVE-2026-48737 pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, isglobaladdress in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user...

CVE-2026-54452

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6true, an attacker-controlled destination in one of these...