2137 matches found
CVE-2025-29446
open-webui v0.5.16 is vulnerable to SSRF in routers/ollama.py in function verifyconnection...
CVE-2025-28197
Crawl4AI =0.4.247 is vulnerable to SSRF in /crawl4ai/asyncdispatcher.py...
Crawl4AI SSRF vulnerability
Crawl4AI =0.4.247 is vulnerable to SSRF in /crawl4ai/asyncdispatcher.py...
CVE-2024-56736 Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss
Server-Side Request Forgery SSRF vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat incubating: before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue...
GHSA-459X-Q9HG-4GPQ Kyverno vulnerable to SSRF via Service Calls
Summary An attacker with the ability to create Kyverno policies in a Kubernetes cluster can use Service Call functionality to perform SSRF to a server under their control in order to exfiltrate data. Details According to the documentation, Service Call is intended to address services located insi...
CVE-2025-32102
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI...
Security Bulletin: IBM Security Guardium is affected by a SSRF vulnerability (CVE-2024-49336)
Summary IBM Security Guardium has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2024-49336 DESCRIPTION: IBM Security Guardium is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system,...
CVE-2025-32102
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI...
CVE-2025-32102
CrushFTP v9.x–11.3.1 is affected by a Server-Side Request Forgery (SSRF) in the /WebInterface/function/ endpoint, exploitable via host and port parameters in a command=telnetSocket request. Root cause: improper handling of host/port in the telnetSocket command allows requests to internal resource...
CVE-2025-31490
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1, AutoGPT allows SSRF due to DNS Rebinding in requests wrapper. AutoGPT is built with a wrapper around Python's requests library, hardenin...
CVE-2025-31490
CVE-2025-31490 affects AutoGPT prior to 0.6.1 and is caused by a DNS rebinding flaw in the requests wrapper used to validate hostnames. The wrapper, located at autogpt_platform/backend/backend/util/request.py, attempts to prevent SSRF by rejecting local IPv4/IPv6 resolutions, but a DNS server’s T...
CVE-2025-31490 AutoGPT allows SSRF due to DNS Rebinding in requests wrapper
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1, AutoGPT allows SSRF due to DNS Rebinding in requests wrapper. AutoGPT is built with a wrapper around Python's requests library, hardenin...
SUSE-SU-2025:1227-1 Security update for pgadmin4
This update for pgadmin4 fixes the following issues: - CVE-2025-27152: axios: Fixed SSRF and creadential leakage due to requests sent to absolute URL even when baseURL is set bsc1239308...
Huawei EulerOS: Security Advisory for python3 (EulerOS-SA-2025-1373)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2025-22374 SSRF in CyberAudit-Web videx-legacy-ssl
A Server-Side Request Forgery SSRF vulnerability was discovered in the videx-legacy-ssl web service of Videx’s CyberAudit-Web, affecting versions prior to 1.1.3. This vulnerability has been patched in versions after 1.1.3. Leaving this vulnerability unpatched could lead to unauthorized access to...
Multiple vulnerabilities in Trend Micro Endpoint security products for enterprises (April 2025)
Overview Trend Micro Incorporated has released security updates for Endpoint security products for enterprises. Trend Micro Incorporated reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN. Impact Trend Micro Apex Central 2019 Information Disclosure due to...
PT-2025-15768 · Waymark · Waymark
Name of the Vulnerable Software and Affected Versions: Waymark versions n/a through 1.5.2 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability, which allows for Server Side Request Forgery. Recommendations: For versions n/a through 1.5.2, update to a version that...
CVE-2025-32013
LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery SSRF vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request ...
CVE-2025-32013 Server-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment System
LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery SSRF vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request ...