9249 matches found
EUVD-2025-32892
A Server-Side Request Forgery SSRF vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The loadfromurl and loadfromurlasync methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows an...
CVE-2025-61784 LLaMA Factory's Chat API has Critical SSRF and LFI Vulnerabilities
LLaMA-Factory is a tuning library for large language models. Prior to version 0.9.4, a Server-Side Request Forgery SSRF vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. This can lead to the exposure ...
CVE-2025-61784 LLaMA Factory's Chat API has Critical SSRF and LFI Vulnerabilities
LLaMA-Factory is a tuning library for large language models. Prior to version 0.9.4, a Server-Side Request Forgery SSRF vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. This can lead to the exposure ...
EUVD-2021-0673
Malware in sbrugna...
vLLM code issues and vulnerabilities
vLLM is a vLLM open source high throughput and memory efficient inference and service engine for LLM. A code issue vulnerability exists in vLLM that stems from insufficient restriction of the target host for user-supplied URLs in the loadfromurl and loadfromurlasync methods of the MediaConnector...
EUVD-2025-32593
KUNO CMS is a fully deployable full-stack blog application. In versions prior to 1.3.15, an SSRF Server-Side Request Forgery vulnerability exists in the Media module of the Kuno CMS administrative panel. A logged-in administrator can upload a specially crafted SVG file containing an external imag...
CVE-2025-61768 Kuno CMS Vulnerable to Server-Side Request Forgery (SSRF) via Unsafe SVG Upload
KUNO CMS is a fully deployable full-stack blog application. In versions prior to 1.3.15, an SSRF Server-Side Request Forgery vulnerability exists in the Media module of the Kuno CMS administrative panel. A logged-in administrator can upload a specially crafted SVG file containing an external imag...
CVE-2025-54087
CVE-2025-54087 is a server-side request forgery vulnerability in Secure Access prior to version 14.10. Attackers with administrative privileges can publish a crafted test HTTP request originating from the Secure Access server. The attack complexity is high, there are no attack requirements, and...
CVE-2025-57305
VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp...
Server-side Request Forgery (SSRF)
Overview @samanhappy/mcphub is an A hub server for mcp servers Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the baseUrl argument in the serverController.ts. An attacker can make the server initiate arbitrary requests to internal or external systems by...
CVE-2025-11286 samanhappy MCPHub MCPRouter Service serverController.ts server-side request forgery
A vulnerability was determined in samanhappy MCPHub up to 0.9.10. This affects an unknown part of the file src/controllers/serverController.ts of the component MCPRouter Service. This manipulation of the argument baseUrl causes server-side request forgery. The attack may be initiated remotely. Th...
CVE-2025-11286 samanhappy MCPHub MCPRouter Service serverController.ts server-side request forgery
A vulnerability was determined in samanhappy MCPHub up to 0.9.10. This affects an unknown part of the file src/controllers/serverController.ts of the component MCPRouter Service. This manipulation of the argument baseUrl causes server-side request forgery. The attack may be initiated remotely. Th...
MCPHub security vulnerabilities
MCPHub is an MCP server management tool by samanhappy individual developer. A security vulnerability exists in MCPHub version 0.9.10 and earlier, which stems from the incorrect manipulation of the parameter baseUrl in the file src/controllers/serverController.ts, which could lead to server-side...
EUVD-2025-25631
Malicious code in bioql PyPI...
EUVD-2025-25699
Malicious code in bioql PyPI...
EUVD-2025-25715
Malicious code in bioql PyPI...
EUVD-2025-25741
Malicious code in bioql PyPI...
EUVD-2025-25760
Malicious code in bioql PyPI...