Lucene search
+L

8423 matches found

EUVD
EUVD
added 6 days ago11 views

EUVD-2026-43722

Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network...

2.7CVSS5.8AI score0.00186EPSS
SaveExploits0References7
Patchstack
Patchstack
added 6 days ago8 views

NPM: swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

NPM: swagger-typescript-api vulnerable to Server-Side Request Forgery via spec $ref vulnerability discovered by ? in WordPress Npm swagger-typescript-api versions = 13.12.1...

6.1CVSS5.8AI score0.00181EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 6 days ago9 views

swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

Summary swagger-typescript-api walks every $ref value in the input OpenAPI spec and, for any $ref whose target is an https:// URL, issues an HTTP GET to that URL during generation warmUpRemoteSchemasCache. The only URL filter is a regex that matches ^https?:// — there is no private-IP allowlist, ...

6.1CVSS6AI score0.00181EPSS
SaveExploits0References5Affected Software1
Cvelist
Cvelist
added 6 days ago28 views

CVE-2026-54663 swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

6.1CVSS0.00181EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 6 days ago8 views

CVE-2026-54663 swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

6.1CVSS5.9AI score0.00181EPSS
SaveExploits0References4
CVE
CVE
added 6 days ago20 views

CVE-2026-54663

swagger-typescript-api before v13.12.2 allows SSRF during code generation via warmUpRemoteSchemasCache: external $ref URLs are fetched with no private IP, DNS rebinding, redirect, or same-origin checks, enabling attacker-controlled OpenAPI specs to trigger requests to internal or link-local servi...

6.1CVSS5.9AI score0.00181EPSS
SaveExploits0References4
EUVD
EUVD
added 6 days ago6 views

EUVD-2026-50364

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

6.1CVSS5.9AI score0.00181EPSS
SaveExploits0References4
NVD
NVD
added 6 days ago8 views

CVE-2026-6089

The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'stickysmedia' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the importsidebars function passing user-supplied URLs from imported JSON data to filegetcontents with...

4.9CVSS0.00278EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 6 days ago7 views

CVE-2026-6089

The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'stickysmedia' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the importsidebars function passing user-supplied URLs from imported JSON data to filegetcontents with...

4.9CVSS5.9AI score0.00278EPSS
SaveExploits0References4Affected Software1
ATTACKERKB
ATTACKERKB
added 6 days ago8 views

CVE-2026-23904

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This...

6AI score0.00309EPSS
SaveExploits0References3Affected Software1
CVE
CVE
added 6 days ago24 views

CVE-2026-23904

Apache Kyuubi contains an SSRF/open-proxy flaw in the Engine UI proxy feature. The Engine UI proxy accepts a host:port from the request path and forwards HTTP requests to that destination, enabling a remote caller with network access to trigger requests to arbitrary reachable hosts. Affected vers...

7.3CVSS6AI score0.00309EPSS
SaveExploits0References3
Cvelist
Cvelist
added 6 days ago27 views

CVE-2026-23904 Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This...

0.00309EPSS
SaveExploits0References2
EUVD
EUVD
added 6 days ago6 views

EUVD-2026-50234

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or...

8.2CVSS5.8AI score0.00377EPSS
SaveExploits0References1
CVE
CVE
added 6 days ago11 views

CVE-2026-58178

The vulnerability CVE-2026-58178 affects the Apache Traffic Server ESI plugin, where unbounded recursion can lead to server-side request forgery by fetching attacker-controlled URLs. Affected versions are 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. The issue is caused by uncontrolled recursion ...

8.2CVSS5.8AI score0.00636EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 6 days ago29 views

CVE-2026-58178 Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery

The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...

8.2CVSS0.00636EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 6 days ago5 views

CVE-2026-58178 Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery

The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...

8.2CVSS5.8AI score0.00636EPSS
SaveExploits0References1
NVD
NVD
added 6 days ago7 views

CVE-2026-11974

The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

8.6CVSS0.00489EPSS
SaveExploits0References1
CVE
CVE
added 6 days ago8 views

CVE-2026-11974

The vulnerability is in the wp-media-folder-addon WordPress plugin up to version 4.1.6. It does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions accessible to unauthenticated users, enabling Arbitrary File Disclosure and Server-Side Request Forge...

8.6CVSS5.8AI score0.00489EPSS
SaveExploits0References1
EUVD
EUVD
added 6 days ago6 views

EUVD-2026-50114

The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

8.6CVSS5.8AI score0.00489EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 6 days ago10 views

PT-2026-65893

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.7 Description The standalone flyto-verification service in src/core/verification service.py exposes an unauthenticated POST '/run' endpoint on 0.0.0.0:8344. The service uses a client-supplied callback url for...

9.3CVSS5.9AI score0.00291EPSS
SaveExploits0References8
Rows per page
Query Builder