Lucene search
+L

8632 matches found

ATTACKERKB
ATTACKERKB
added 2026/04/10 7:15 p.m.3 views

CVE-2026-30232

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew allows authenticated users to create API data connections with arbitrary URLs. The server fetches these URLs using request-promise without any I...

7.8CVSS5.9AI score0.00242EPSS
SaveExploits0References3Affected Software1
NVD
NVD
added 2026/04/10 6:16 p.m.8 views

CVE-2026-31941

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains a Server-Side Request Forgery SSRF vulnerability in the Social Wall feature. The endpoint readurlwithopengraph accepts a URL from the user via the socialwallnewmsgmain POST parameter and performs tw...

7.7CVSS0.00231EPSS
SaveExploits0References3
OSV
OSV
added 2026/04/10 5:37 p.m.9 views

CVE-2026-31941 Server-Side Request Forgery (SSRF) in Chamilo LMS

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains a Server-Side Request Forgery SSRF vulnerability in the Social Wall feature. The endpoint readurlwithopengraph accepts a URL from the user via the socialwallnewmsgmain POST parameter and performs tw...

7.7CVSS6.1AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/04/10 5:37 p.m.27 views

CVE-2026-31941 Server-Side Request Forgery (SSRF) in Chamilo LMS

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains a Server-Side Request Forgery SSRF vulnerability in the Social Wall feature. The endpoint readurlwithopengraph accepts a URL from the user via the socialwallnewmsgmain POST parameter and performs tw...

7.7CVSS0.00231EPSS
SaveExploits0References3
CVE
CVE
added 2026/04/10 4:39 p.m.30 views

CVE-2026-40100

CVE-2026-40100 affects FastGPT prior to version 4.14.10.3. The /api/core/app/mcpTools/runTool endpoint accepts arbitrary URLs without authentication; the internal IP check in isInternalAddress() only blocks private IPs when CHECK_INTERNAL_IP is true (not the default), enabling unauthenticated SSR...

5.3CVSS5.9AI score0.00253EPSS
SaveExploits0References1Affected Software1
OSV
OSV
added 2026/04/10 6:31 a.m.7 views

GHSA-52VJ-FVRV-7Q82 OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts

A weakness has been identified in OpenClaw up to 2026.1.26. Affected by this issue is some unknown functionality of the file src/agents/tools/web-fetch.ts of the component assertPublicHostname Handler. Executing a manipulation can lead to server-side request forgery. The attack can be executed...

6.3CVSS5.2AI score0.0042EPSS
SaveExploits1References8
NVD
NVD
added 2026/04/10 5:16 a.m.7 views

CVE-2026-6011

A weakness has been identified in OpenClaw up to 2026.1.26. Affected by this issue is some unknown functionality of the file src/agents/tools/web-fetch.ts of the component assertPublicHostname Handler. Executing a manipulation can lead to server-side request forgery. The attack can be executed...

8.1CVSS0.0042EPSS
SaveExploits1References7
OSV
OSV
added 2026/04/10 3:45 a.m.8 views

CVE-2026-6011 OpenClaw assertPublicHostname web-fetch.ts server-side request forgery

A weakness has been identified in OpenClaw up to 2026.1.26. Affected by this issue is some unknown functionality of the file src/agents/tools/web-fetch.ts of the component assertPublicHostname Handler. Executing a manipulation can lead to server-side request forgery. The attack can be executed...

6.3CVSS5.4AI score
SaveExploits0References9
Cvelist
Cvelist
added 2026/04/10 3:45 a.m.44 views

CVE-2026-6011 OpenClaw assertPublicHostname web-fetch.ts server-side request forgery

A weakness has been identified in OpenClaw up to 2026.1.26. Affected by this issue is some unknown functionality of the file src/agents/tools/web-fetch.ts of the component assertPublicHostname Handler. Executing a manipulation can lead to server-side request forgery. The attack can be executed...

6.3CVSS0.0042EPSS
SaveExploits1References7
CVE
CVE
added 2026/04/10 3:45 a.m.35 views

CVE-2026-6011

OpenClaw (up to version 2026.1.26) contains a vulnerability in the file src/agents/tools/web-fetch.ts (assertPublicHostname handler) that enables server-side request forgery when a crafted request manipulates internal hostname handling. Exploitation is network-based with high complexity as descri...

8.1CVSS5.5AI score0.0042EPSS
SaveExploits1References7Affected Software1
EUVD
EUVD
added 2026/04/10 12:30 a.m.5 views

EUVD-2026-21116

OpenClaw before 2026.3.25 contains a server-side request forgery vulnerability in multiple channel extensions that fail to properly guard configured base URLs against SSRF attacks. Attackers can exploit unprotected fetch calls against configured endpoints to rebind requests to blocked internal...

7.4CVSS5.9AI score0.00244EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/04/10 12:0 a.m.13 views

PT-2026-32033

GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malicious URL via the doc url parameter during document upload...

5.3CVSS5.9AI score0.00222EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/04/10 12:0 a.m.27 views

PT-2026-32001

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.38 and prior to 2.0.0-RC.3 Description Chamilo LMS contains a Server-Side Request Forgery SSRF vulnerability in the Social Wall feature. The /read url with open graph endpoint accepts a URL from the user via...

7.7CVSS5.9AI score0.00231EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/04/10 12:0 a.m.29 views

PT-2026-31871

Name of the Vulnerable Software and Affected Versions OpenClaw versions through 2026.1.26 Description A weakness exists in OpenClaw up to version 2026.1.26, specifically within the assertPublicHostname Handler functionality of the file src/agents/tools/web-fetch.ts. A manipulation can lead to...

8.1CVSS5.5AI score0.0042EPSS
SaveExploits1References12
CNNVD
CNNVD
added 2026/04/10 12:0 a.m.16 views

GeoNode 代码问题漏洞

GeoNode is an open-source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Versions of GeoNode prior to 4.4.5 and 5.0.2 have code vulnerabilities due to insufficient validation of the docurl parameter, which may lead to server-side request forgeing attack...

6.3CVSS5.9AI score0.00222EPSS
SaveExploits0References4
CNNVD
CNNVD
added 2026/04/10 12:0 a.m.20 views

OpenClaw 代码问题漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.1.26 have code vulnerabilities. These vulnerabilities stem from incorrect operations on the src/agents/tools/web-fetch.ts file, which may lead to server-side request forgery attac...

8.1CVSS6.3AI score0.0042EPSS
SaveExploits1References7
CNNVD
CNNVD
added 2026/04/10 12:0 a.m.15 views

FastGPT 代码问题漏洞

FastGPT is an open-source knowledge base question-answering system based on large language models, developed by Labring. Versions of FastGPT prior to 4.14.10.3 contained code vulnerabilities. These vulnerabilities stemmed from the unvalidated acceptance of any URL via the...

5.3CVSS5.9AI score0.00253EPSS
SaveExploits0References2
CNNVD
CNNVD
added 2026/04/10 12:0 a.m.15 views

GeoNode 代码问题漏洞

GeoNode is an open-source platform developed by GeoNode, designed to facilitate the creation, sharing, and collaborative use of geospatial data. Versions of GeoNode prior to 4.4.5 and 5.0.2 contained code vulnerabilities. These vulnerabilities stemmed from insufficient validation of service...

6.3CVSS5.9AI score0.00172EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/04/10 12:0 a.m.17 views

PT-2026-32029

Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the initially supplied URL and blocks direct private/internal hosts, it does not re-validate the final destination after HTTP redirects. As a...

8.2CVSS5.8AI score0.00371EPSS
SaveExploits1References4
Positive Technologies
Positive Technologies
added 2026/04/10 12:0 a.m.10 views

PT-2026-32034

Name of the Vulnerable Software and Affected Versions GeoNode versions 4.0 through 4.4.5 and 5.0 through 5.0.2 Description GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 are affected by a server-side request forgery issue in the service registration endpoint. Authenticated attackers can...

6.3CVSS5.6AI score0.00172EPSS
SaveExploits0References13
Rows per page
Query Builder