CVE-2026-3163

A vulnerability has been found in SourceCodester Website Link Extractor 1.0. This vulnerability affects the function filegetcontents of the component URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed ...

CVE-2026-3163

A vulnerability has been found in SourceCodester Website Link Extractor 1.0. This vulnerability affects the function filegetcontents of the component URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed ...

CVE-2026-3163 SourceCodester Website Link Extractor URL file_get_contents server-side request forgery

A vulnerability has been found in SourceCodester Website Link Extractor 1.0. This vulnerability affects the function filegetcontents of the component URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed ...

CVE-2026-3163

A vulnerability has been found in SourceCodester Website Link Extractor 1.0. This vulnerability affects the function filegetcontents of the component URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed ...

CVE-2026-27696 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs

changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, changedetection.io is vulnerable to Server-Side Request Forgery SSRF because the URL validation function issafevalidurl does not validate the resolved IP address of watch URLs against private,...

CVE-2026-3052

A vulnerability was found in DataLinkDC dinky up to 1.2.5. The impacted element is the function proxyUba of the file dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java of the component Flink Proxy Controller. Performing a manipulation results in server-side request forgery. ...

Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017

This module enables you to easily theme and build an entire website using only their browser, without the need to write code beyond basic JSX and CSS. Content creators are able to compose content on any part of the page without relying on developers. The project has a hidden sub-module, Drupal...

Sz-Admin Code Issues and Vulnerabilities

Sz-Admin is a mid-backend management software developed by INS6+ individual developers. Versions of Sz-Admin such as 1.3.2-beta and earlier contained code vulnerabilities. These vulnerabilities stemmed from incorrect handling of parameters in the files/download file and API, particularly the url...

PT-2026-22057

Name of the Vulnerable Software and Affected Versions Mailpit versions prior to 1.29.2 Description Mailpit is an email testing tool and API for developers. A Server-Side Request Forgery SSRF issue exists in the Link Check API. This allows unauthenticated remote attackers to map internal networks...

esm.sh code issue vulnerabilities

esm.sh is an open-source content distribution network developed by esm.sh. Version 136 of esm.sh has a code vulnerability that stems from a complete server-side request forgery attack, which may lead to the retrieval of information from internal websites...

PT-2026-21890

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.1. This is due to the use of strpos for substring-based hostname validation instead of strict host comparison in the ajax upload image function. This makes...

WordPress plugin Responsive Lightbox & Gallery: Code issues and vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

Kruise code issue vulnerabilities

Kruise is an open-source application developed by OpenKruise. Versions of Kruise prior to 1.8.3 and 1.7.5 contained code vulnerabilities. These vulnerabilities stemmed from the lack of restrictions on the Host field in the PodProbeMarker’s webhook validation, which could allow attackers with...

changedetection.io security vulnerability

Changedetection.io is a website monitoring and notification application developed by dgtlmoon. Versions of Changedetection.io prior to 0.54.1 contained security vulnerabilities. These vulnerabilities stemmed from the URL validation function, issafevalidurl, which did not validate the resolution I...

PT-2026-21867

Name of the Vulnerable Software and Affected Versions changedetection.io versions prior to 0.54.1 Description changedetection.io is a web page change detection tool susceptible to Server-Side Request Forgery SSRF. The is safe valid url function does not properly validate the resolved IP address o...

PT-2026-21936

Name of the Vulnerable Software and Affected Versions esm.sh versions up to and including 137 Description esm.sh is a content delivery network CDN for web development. A server-side request forgery SSRF issue CWE-918 exists in the /https fetch route. The service attempts to prevent requests to...

esm.sh code issue vulnerabilities

esm.sh is an open-source content distribution network developed by esm.sh. Versions of esm.sh 137 and earlier contained code vulnerabilities. These vulnerabilities stemmed from a server-side request forgeing vulnerability in the https routing mechanism of esm.sh. The service attempted to block...

LangChain.js code issues and vulnerabilities

LangChain.js is an open-source implementation of a context-aware reasoning application developed by LangChain. Versions of LangChain.js prior to 1.1.8 contained code vulnerabilities. These vulnerabilities stemmed from the RecursiveUrlLoader component, which allowed unauthorized access to...

Plane code issue vulnerabilities

Plane is an open-source, self-hosted project planning tool developed by Plane OpenSource. Versions of Plane prior to 1.2.2 contained code vulnerabilities. These vulnerabilities stemmed from a flaw in the link addition function, which allowed for a full read server-side request forgeing...

PT-2026-21874

A vulnerability has been found in SourceCodester Website Link Extractor 1.0. This vulnerability affects the function file get contents of the component URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclose...