CVE-2026-79880

A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery SSRF attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-115364

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When requirerequestheader is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down the...

CVE-2026-115364 OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When requirerequestheader is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down the...

CVE-2026-115364

OpenBao versions prior to 2.6.3 are vulnerable to a missing authorization check that can lead to a denial of service. If the require_request_header setting is enabled, an attacker can perform a server-side request forgery (SSRF) by omitting the X-Vault-Header . This allows the attacker to reach t...

EUVD-2026-108289

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When requirerequestheader is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down the...

CVE-2026-79880

This vulnerability involves an Authenticated Server-Side Request Forgery (SSRF) in AOS-8 which can lead to Remote Code Execution . While the provided documents do not specify the exact component, version, or root cause, the impact includes potential unauthorized code execution. No specific remedi...

CVE-2026-108357

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after...

CVE-2026-108358

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escap...

EUVD-2026-108242

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after...

EUVD-2026-108265

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escap...

CVE-2026-108360 PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permit...

CVE-2026-108360

The PhpSpreadsheet PHP library is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. The root cause is that Worksheet oc.Drawing::setPath only validates the initial external-image URL against a whitelist when setAllowExternalImages is ...

CVE-2026-108360 PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permit...

CVE-2026-115411

crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated addres...

Exploit for Server-Side Request Forgery in Plex Media_Server

CVE-2026-96652 — Plex Media Server timeline SSRF PoC and veri...

Azure AI Foundry Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Azure AI Foundry allows an authorized attacker to elevate privileges over a network...

EUVD-2026-108164

crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated addres...

CVE-2026-115411 crawlseo before 0.2.4 Server-Side Request Forgery via Crawler

crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated addres...

CVE-2026-115411 crawlseo before 0.2.4 Server-Side Request Forgery via Crawler

crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated addres...

CVE-2026-115411

The crawlseo crawler engine (versions before 0.2.4 ) is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is that the isPrivateIp() function fails to block specific reserved IP ranges, including RFC 6598 Carrier-Grade NAT , RFC 6890 , and TEST-NET ranges. Furthermore, the engine...