CVE-2026-114374

A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadataapi.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The...

EUVD-2026-107539

A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadataapi.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The...

EUVD-2026-107502

A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument baseurl can lead to server-side request forgery. The attack may be performed from remote. Upgrading to...

CVE-2026-114362

A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument baseurl can lead to server-side request forgery. The attack may be performed from remote. Upgrading to...

CVE-2026-92210

NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2026-92203

Airbyte SharePoint Connector getshareddriveobject Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability...

CVE-2026-92204

Airbyte OneDrive Connector getshareddriveobject Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. T...

Trigger.dev: Blind SSRF Via Alert-channel Webhook

Summary A WEBHOOK alert channel stores a user-supplied "url". When an alert fires deployment/run failure, error groups, the webapp server "alertsWorker" - "DeliverAlertService" POSTs the HMAC-signed alert payload to that URL via "fetchwebhook.url, ...". The URL is never validated against a host...

CVE-2026-114493 LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those...

CVE-2026-114493 LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those...

CVE-2026-114493

LocalAI versions v4.6.0 through v4.11.0 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the core/gallery/gallery.go component. The root cause is that the application only validates the initial gallery configuration URL. An attacker can submit a configuration URL via PO...

CVE-2026-114493 LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those...

EUVD-2026-107402

Airbyte OneDrive Connector getshareddriveobject Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. T...

CVE-2026-92204 Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability

Airbyte OneDrive Connector getshareddriveobject Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. T...

CVE-2026-92204

Airbyte OneDrive Connector getshareddriveobject Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. T...

CVE-2026-92204

The Airbyte OneDrive Connector is vulnerable to a Server-Side Request Forgery (SSRF) and Information Disclosure vulnerability in the _get_shared_drive_object method. The root cause is a lack of proper validation of a URI before the application accesses resources. This flaw allows an authenticated...

CVE-2026-92203 Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability

Airbyte SharePoint Connector getshareddriveobject Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability...

EUVD-2026-107401

Airbyte SharePoint Connector getshareddriveobject Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability...

CVE-2026-92203

Airbyte SharePoint Connector getshareddriveobject Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability...

CVE-2026-92203

The Airbyte SharePoint Connector is vulnerable to a Server-Side Request Forgery (SSRF) information disclosure vulnerability within the _get_shared_drive_object method. The root cause is a lack of proper validation of a URI before the application accesses resources. An authenticated remote attacke...