Lucene search
+L

12519 matches found

OSV
OSV
added 2026/08/20 9:35 p.m.9 views

CVE-2026-72860 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

6.3CVSS5.8AI score
SaveExploits0References9
CVE
CVE
added 2026/08/20 9:35 p.m.24 views

CVE-2026-72860

9router 's POST /api/provider-nodes/validate route is vulnerable to Server-Side Request Forgery (SSRF) due to a flaw in its assertPublicUrl guard (src/shared/utils/ssrfGuard.js). The IPv4-mapped IPv6 denylist regex is unreachable because the WHATWG URL parser canonicalizes such literals to hextet...

8.5CVSS5.4AI score0.00218EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/20 9:35 p.m.29 views

CVE-2026-72860 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

8.5CVSS0.00218EPSS
SaveExploits0References6
Github Security Blog
Github Security Blog
added 2026/08/20 6:30 p.m.8 views

stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address

Summary Stigmem allows an authenticated user to create a webhook subscription with a user-controlled deliveryaddress. That value is stored and later used directly by the subscription delivery worker as the destination of a server-side HTTP POST request. The codebase already contains an outbound...

5.7AI score
SaveExploits0References6Affected Software1
Kitploit
Kitploit
added 2026/08/20 6:30 p.m.2 views

blind-ssrf-chains

介绍 什么是服务端请求伪造(SSRF)? 服务端请求伪造发生在当你能够迫使服务器代表你发起任意请求时。由于请求是由服务器发起的,因此有可能根据服务器在网络中的位置访问内部资源。在云环境中,由于存在可能包含敏感凭证或密钥的元数据端点,SSRF 构成了更重大的风险。 盲 SSRF 在利用服务端请求伪造时,我们常常会发现自己处于无法读取响应的情况。在行业中,这种行为通常被称为“盲 SSRF”。在这种情况下,我们如何证明其影响?这是由 Justin Gardner 在 Twitter 上引发的一场有趣的讨论: 最近我发现了大量的盲...

9.8CVSS0.99856EPSS
SaveExploits36References2
NVD
NVD
added 2026/08/20 5:19 p.m.10 views

CVE-2026-71428

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partitionhtml, and partitionmd is fetched without host validation in...

9.3CVSS0.0025EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/20 5:18 p.m.10 views

CVE-2026-61704

Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address...

7.5CVSS0.00403EPSS
SaveExploits0References5
NVD
NVD
added 2026/08/20 5:18 p.m.8 views

CVE-2026-54770

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response.makelocationabsolute in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin strips leading C0 control characters and spaces. An attacker-controlled valu...

6.1CVSS0.00339EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/20 4:43 p.m.10 views

CVE-2026-71428 unstructured: Server-Side Request Forgery in the URL-based partitioning

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partitionhtml, and partitionmd is fetched without host validation in...

9.3CVSS5.4AI score
SaveExploits0References6
CVE
CVE
added 2026/08/20 4:43 p.m.24 views

CVE-2026-71428

CVE-2026-71428 is a Server-Side Request Forgery (SSRF) in the unstructured Python library (versions 0.4.7 through 0.24.0 ). The url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.p...

9.3CVSS5.3AI score0.0025EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/20 4:43 p.m.9 views

EUVD-2026-63472

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partitionhtml, and partitionmd is fetched without host validation in...

9.3CVSS5.3AI score0.0025EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/20 4:40 p.m.33 views

CVE-2026-65842 Plate: SSRF with response disclosure in DOCX image embedding

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the...

8.2CVSS0.00301EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/20 4:40 p.m.9 views

CVE-2026-65842 Plate: SSRF with response disclosure in DOCX image embedding

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the...

8.2CVSS5.5AI score
SaveExploits0References6
CVE
CVE
added 2026/08/20 4:21 p.m.18 views

CVE-2026-61704

In the npm package link-preview-js , the resolveDNSHost function in index.ts validates only one resolved IP address but then fetches using the original hostname, enabling DNS rebinding that bypasses SSRF protections and lets server-side preview fetches reach internal HTTP resources. Redirect hand...

7.5CVSS5.3AI score0.00403EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/20 4:21 p.m.29 views

CVE-2026-61704 link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address...

7.5CVSS0.00403EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/08/20 4:21 p.m.11 views

EUVD-2026-63439

Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address...

7.5CVSS5.4AI score0.00403EPSS
SaveExploits0References5
OSV
OSV
added 2026/08/20 4:21 p.m.9 views

CVE-2026-61704 link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address...

7.5CVSS5.5AI score
SaveExploits0References7
NVD
NVD
added 2026/08/20 4:17 p.m.8 views

CVE-2026-63044

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

5.4CVSS0.00208EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/08/20 4:08 p.m.8 views

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

7.7CVSS6.7AI score0.00366EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/08/20 3:57 p.m.30 views

CVE-2026-63044 Apache InLong: Authenticated SSRF via POST /api/node/testConnection

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

0.00208EPSS
SaveExploits0References1
Rows per page
Query Builder