CVE-2025-6087 SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint

A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /next/image endpoint...

CVE-2025-6087 SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint

A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /next/image endpoint...

Astra Linux – Vulnerability in Python 3.11

The urllib.parse.urlsplit and urlparse functions improperly validate bracketed hosts , allowing hosts that are neither IPv6 nor IPvFuture. This behavior does not conform to RFC 3986 and could potentially enable SSRF if a URL is processed by more than one URL parser...

PT-2025-25581

Name of the Vulnerable Software and Affected Versions @opennextjs/cloudflare versions prior to 1.3.0 create-cloudflare versions prior to 2.49.3 Description A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an...

PT-2025-25594 · Unknown · Intera Inhire

Name of the Vulnerable Software and Affected Versions: Intera InHire up to 20250530 Description: A critical vulnerability was found in Intera InHire, affecting an unknown functionality. The manipulation of the argument 29chcotoo9 leads to server-side request forgery. The attack can be launched...

CVE-2025-49190

The application is vulnerable to Server-Side Request Forgery SSRF. An endpoint can be used to send server internal requests to other ports...

Security Bulletin: A vulnerability in axios affects IBM Robotic Process Automation and could result in credential leakage (CVE-2025-27152)

Summary A vulnerability in axios affects IBM Robotic Process Automation and could result in credential leakage CVE-2025-27152. Axios is used by IBM Robotic Process Automation as part of the User Inteface. This security bulletin identifies the fixes to resolve the vulnerability. Vulnerability...

WordPress ProfileGrid plugin <= 5.9.5.2 - Server Side Request Forgery (SSRF) Vulnerability

Server Side Request Forgery SSRF Vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin ProfileGrid versions = 5.9.5.2...

CVE-2023-48786

A server-side request forgery vulnerability CWE-918 in Fortinet FortiClientEMS version 7.4.0 through 7.4.2 and before 7.2.6 may allow an authenticated attacker to perform internal requests via crafted HTTP or HTTPS requests...

CVE-2025-49190 Server-Side Request Forgery

The application is vulnerable to Server-Side Request Forgery SSRF. An endpoint can be used to send server internal requests to other ports...

CVE-2025-49190 Server-Side Request Forgery

The application is vulnerable to Server-Side Request Forgery SSRF. An endpoint can be used to send server internal requests to other ports...

CVE-2025-49190

CVE-2025-49190 is associated with a Server-Side Request Forgery (SSRF) in SICK Field Analytics and SICK Media Server. The linked Sick PSIRT entry states multiple vulnerabilities in those products could affect confidentiality, integrity, and availability, with SSRF allowing an endpoint to initiate...

CVE-2025-44043

Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Side Request Forgery SSRF in /KeyotiSearchEngineWebCommon/SearchService.svc/GetResults and /KeyotiSearchEngineWebCommon/SearchService.svc/GetLocationAndContentCategories. An attacker can specify their own SMB server as the indexDirectory...

PT-2025-25316 · Sick Ag · Sick Field Analytics

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The application is vulnerable to Server-Side Request Forgery SSRF, which allows an endpoint to be used for sending server internal requests to other ports. Recommendations: At the moment,...

GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx

Summary Missing checks allow for SSRF to specific targets using the TestWfsPost enpoint. Mitigation To manage the proxy base value as a system administrator, use the parameter PROXYBASEURL to provide a non-empty value that cannot be overridden by the user interface or incoming request.thomsmith...

[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service

Summary GeoServer Web Feature Service WFS web service was found to be vulnerable to GeoTools CVE-2025-30220 XML External Entity XXE processing attack. It is possible to trigger the parsing of external DTDs and entities, bypassing standard entity resolvers. This allows for Out-of-Band OOB data...

GHSA-JJ54-8F66-C5PC [XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service

Summary GeoServer Web Feature Service WFS web service was found to be vulnerable to GeoTools CVE-2025-30220 XML External Entity XXE processing attack. It is possible to trigger the parsing of external DTDs and entities, bypassing standard entity resolvers. This allows for Out-of-Band OOB data...

CVE-2025-36576

Dell Wyse Management Suite, versions prior to WMS 5.2, contain a Cross-Site Request Forgery CSRF vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...

CVE-2025-36576

Dell Wyse Management Suite, versions prior to WMS 5.2, contain a Cross-Site Request Forgery CSRF vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...

CVE-2025-36576

Dell Wyse Management Suite, versions prior to WMS 5.2, contain a Cross-Site Request Forgery CSRF vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...