CVE-2026-15525

A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function validateurls of the file src/adloop/ads/write.py. Performing a manipulation of the argument finalurl results in server-side request forgery. The attack may be initiated remotely. The exploit is now...

EUVD-2026-43267

A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function validateurls of the file src/adloop/ads/write.py. Performing a manipulation of the argument finalurl results in server-side request forgery. The attack may be initiated remotely. The exploit is now...

CVE-2026-15525 kLOsk adloop write.py _validate_urls server-side request forgery

A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function validateurls of the file src/adloop/ads/write.py. Performing a manipulation of the argument finalurl results in server-side request forgery. The attack may be initiated remotely. The exploit is now...

CVE-2026-15525

A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function validateurls of the file src/adloop/ads/write.py. Performing a manipulation of the argument finalurl results in server-side request forgery. The attack may be initiated remotely. The exploit is now...

CVE-2026-15525

CVE-2026-15525 affects the kLOsk adloop package up to version 0.9.0. The vulnerability is in the function _validate_urls in src/adloop/ads/write.py, where manipulating the argument final_url can trigger a server-side request forgery (SSRF). The issue can be exploited remotely and the exploit is p...

CVE-2026-15525 kLOsk adloop write.py _validate_urls server-side request forgery

A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function validateurls of the file src/adloop/ads/write.py. Performing a manipulation of the argument finalurl results in server-side request forgery. The attack may be initiated remotely. The exploit is now...

CVE-2026-15525 kLOsk adloop write.py _validate_urls server-side request forgery

A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function validateurls of the file src/adloop/ads/write.py. Performing a manipulation of the argument finalurl results in server-side request forgery. The attack may be initiated remotely. The exploit is now...

EUVD-2026-43249

A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function buildtargeturl of the file ai-gateway/src/dispatcher/service.rs of the component AWS Metadata Service. Executing a manipulation of the argument extractedpathandquery can lead to server-side request forgery...

PT-2026-57904

Name of the Vulnerable Software and Affected Versions CrewAI versions prior to 1.15.1 Description A server-side request forgery SSRF issue exists in the validate url function. The function performs one-shot DNS resolution and blocklist checks but returns the original URL unchanged. This allows...

PT-2026-57612

A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function validate urls of the file src/adloop/ads/write.py. Performing a manipulation of the argument final url results in server-side request forgery. The attack may be initiated remotely. The exploit is now...

PT-2026-59385

Summary The SafePlaywrightURLLoader implements a validate url function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only on the initial URL. Since Playwright automatically follows HTTP redirects 301/302 by default, an attacker...

PT-2026-59377

Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts Affected Component Folder creation endpoint and form model: - backend/open webui/models/folders.py lines 72-77, FolderForm with extra='allow' - backend/open webui/models/folders.py lines 95-106, insert new...

Linux Distros Unpatched Vulnerability : CVE-2026-15146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that...

PT-2026-57718

Name of the Vulnerable Software and Affected Versions PDF Generator for WordPress versions prior to 1.6.3 Description A Server-Side Request Forgery SSRF issue exists in the PDF Generator for WordPress plugin. This flaw allows an unauthenticated attacker to induce the server to make requests to...

PT-2026-60023

Summary A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input. Details File: weasyprint/css/ init .py The...

Progress MOVEit Transfer < 2024.1.8 / 2025.0.x < 2025.0.4 / 2025.1 Server-Side Request Forgery (November 2025)

The version of Progress MOVEit Transfer, formerly Ipswitch MOVEit DMZ, installed on the remote host is affected by a server-side request forgery vulnerability. - Server-Side Request Forgery SSRF vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2024.1.8, from...

gitea -- Multiple vulnerabilities

Gitea reports This release contains fixes for 45 security issues, including privilege escalation, remote denial of service, server-side request forgery, authorization and token scope bypasses, and information disclosure vulnerabilities. Please upgrade as soon as possible...

CVE-2025-45869

CVE-2025-45869 affects LogicalDOC Enterprise up to and before v9.1.1. The vulnerability is a Server-Side Request Forgery (SSRF) in the ShareFileCallback servlet, exploitable by an unauthenticated attacker who can manipulate input parameters to trigger a server-side request to an attacker-controll...

PT-2026-59573

Summary PraisonAI's spider tools URL validation can be bypassed using alternate loopback host encodings. The affected component is: text praisonaiagents/tools/spider tools.py The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled...

PT-2026-59014

A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function get bytes from web url of the file src/agentscope/ utils/ common.py of the component Internal Service. Performing a manipulation results in server-side request forgery. It is possible to initiate...