Lucene search
+L

8605 matches found

CVE
CVE
added 5 days ago43 views

CVE-2026-18856

CVE-2026-18856 affects Poesis Rhymix CMS up to version 2.1.33. The vulnerability resides in the function procImporterAdminCheckXmlFile (modules/importer/importer.admin.controller.php) and enables server-side request forgery via manipulation of the filename argument. Exploitation can be remote; th...

5.8CVSS5.1AI score0.00227EPSS
SaveExploits0References7
Jenkins Security Advisories
Jenkins Security Advisories
added 5 days ago6 views

XXE vulnerability in ivy-report

ivy-report 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted Ivy report XML file that uses external entities for extraction of secrets from the Jenkins controller o...

7.1CVSS5.6AI score0.00194EPSS
SaveExploits0Affected Software1
NVD
NVD
added 6 days ago10 views

CVE-2026-70620

Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind...

6.8CVSS0.00264EPSS
SaveExploits0References5
Patchstack
Patchstack
added 6 days ago6 views

NPM: Ghost: Server-Side Request Forgery in Image Fetching

NPM: Ghost: Server-Side Request Forgery in Image Fetching vulnerability discovered by ? in WordPress Npm ghost versions = 0.10.0, 6.54.1...

4.1CVSS5.4AI score0.00226EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 6 days ago10 views

Ghost: Server-Side Request Forgery in Image Fetching

Impact A Server-Side Request Forgery SSRF in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. Vulnerable versions This vulnerability is present in Ghost...

4.1CVSS5.5AI score0.00226EPSS
SaveExploits0References4Affected Software1
CVE
CVE
added 6 days ago48 views

CVE-2026-70591

Ghost is a Node.js content management system. From version 0.10.0 up to 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET to internal hosts; no output was returned but it could be used to probe internal ports. The issue is...

4.1CVSS5.5AI score0.00226EPSS
SaveExploits0References3
Cvelist
Cvelist
added 6 days ago34 views

CVE-2026-70620 Odysseus SSRF via Embedding Endpoint Configuration

Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind...

6.8CVSS0.00264EPSS
SaveExploits0References5
OSV
OSV
added 6 days ago5 views

CVE-2026-66901 Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON

Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the...

7.5CVSS5.5AI score
SaveExploits0References10
CVE
CVE
added 6 days ago41 views

CVE-2026-66901

CVE-2026-66901 : Google::Auth for Perl before version 0.09 is prone to server-side request forgery and credential exfiltration due to unvalidated URLs sourced from the credentials JSON. The attack could reach hosts in the configuration’s network position (including internal services and metadata ...

7.5CVSS5.5AI score0.00333EPSS
SaveExploits0References6
Github Security Blog
Github Security Blog
added 6 days ago10 views

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Summary With the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing the request. That check only ran for the top-level page request. Every other request the page issued was passed through unvalidated, so a pa...

7.7CVSS5.5AI score0.0026EPSS
SaveExploits0References5Affected Software1
NVD
NVD
added 6 days ago9 views

CVE-2026-47617

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery via DNS rebinding. A successful exploit of this vulnerability might lead to information disclosure...

7.5CVSS0.00319EPSS
SaveExploits0References3
NVD
NVD
added 6 days ago9 views

CVE-2026-47616

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure...

7.5CVSS0.00319EPSS
SaveExploits0References3
NVD
NVD
added 6 days ago6 views

CVE-2026-47618

NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure...

7.5CVSS0.00319EPSS
SaveExploits0References3
NVD
NVD
added 6 days ago9 views

CVE-2026-47614

NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure...

7.5CVSS0.00319EPSS
SaveExploits0References3
CVE
CVE
added 6 days ago39 views

CVE-2026-47618

CVE-2026-47618 affects NVIDIA Dynamo for Linux, specifically the Rust multimodal media fetcher. The vulnerability enables server-side request forgery (SSRF) that could lead to information disclosure. The NVIDIA bulletin lists affected versions (0 to v1.1.0) updated to v1.1.1, with additional fixe...

7.5CVSS5.5AI score0.00319EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
added 6 days ago36 views

CVE-2026-47618

NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure...

7.5CVSS0.00319EPSS
SaveExploits0References3
Cvelist
Cvelist
added 6 days ago38 views

CVE-2026-47617

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery via DNS rebinding. A successful exploit of this vulnerability might lead to information disclosure...

7.5CVSS0.00319EPSS
SaveExploits0References3
CVE
CVE
added 6 days ago39 views

CVE-2026-47617

Summary (CVE-2026-47617) : NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher that could allow an attacker to perform a server-side request forgery via DNS rebinding , with potential information disclosure . The CVSS vector (Network, Low attack complexity, No privile...

7.5CVSS5.5AI score0.00319EPSS
SaveExploits0References3Affected Software1
RedhatCVE
RedhatCVE
added 6 days ago7 views

CVE-2026-15307

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

8.8CVSS6AI score0.00538EPSS
SaveExploits0References10
Cvelist
Cvelist
added 6 days ago36 views

CVE-2026-47616

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure...

7.5CVSS0.00319EPSS
SaveExploits0References3
Rows per page
Query Builder