CVE-2026-47616

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-47616

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher that could allow a network attacker to trigger a server-side request forgery, potentially leading to information disclosure. Affected software: NVIDIA Dynamo for Linux. Root cause/impact: SSRF in multimodal media fet...

EUVD-2026-52809

NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery by supplying a crafted URL in a multimodal request. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-47615

NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery by supplying a crafted URL in a multimodal request. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-47615

Summary: CVE-2026-47615 affects NVIDIA Dynamo for Linux. Affected component: server-side request forgery via a crafted URL in a multimodal request, with potential information disclosure as the impact. Root cause and exact vulnerable subcomponent are described in the NVIDIA/NVD entries. CVSSv3.1 m...

EUVD-2026-52806

NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-47614

NVIDIA Dynamo for Linux contains a vulnerability (CVE-2026-47614) that could allow server-side request forgery leading to information disclosure. The NVIDIA security bulletin lists this CVE among several SSRF issues and recommends updating affected Linux releases to a newer Dynamo version (update...

CVE-2026-47614

NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-18775

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browsersnapshot of the file tools/browsertool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The...

CVE-2026-18775

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-18775 NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browsersnapshot of the file tools/browsertool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The...

CVE-2026-18774

CVE-2026-18774 affects NousResearch hermes-agent up to 0.16.0, specifically the xAI Image Generation Provider component. The vulnerability lies in the save_url_image function in agent/image_gen_provider.py, enabling server-side request forgery. The attack vector is network-based with low privileg...

EUVD-2026-52764

A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function saveurlimage of the file agent/imagegenprovider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has...

CVE-2026-69257

Flowise prior to v3.1.3 had an SSRF protection bypass in its HTTP security module due to improper handling of IPv4-mapped IPv6 addresses (::ffff:127.0.0.1, ::ffff:169.254.169.254). ipaddr.js categorizes these as IPv6, so IPv4 CIDR deny-list checks were skipped in isDeniedIP(), allowing requests f...

CVE-2026-15307 Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

WordPress Paytm Payment Gateway <=2.7.0 - Server-Side Request Forgery

WordPress Paytm Payment Gateway plugin through 2.7.0 contains a server-side request forgery vulnerability. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized...

EspoCRM <= 9.3.3 - Server-Side Request Forgery

EspoCRM = 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost, letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint. id: CVE-2026-33534...

LiteLLM - Server-Side Request Forgery

LiteLLM vulnerable to Server-Side Request Forgery SSRF vulnerability Exposes OpenAI API Keys. id: CVE-2024-6587 info: name: LiteLLM - Server-Side Request Forgery author: pdresearch,iamnoooob,rootxharsh,lambdasawa severity: high description: | LiteLLM vulnerable to Server-Side Request Forgery SSRF...

Radio Player <= 2.0.82 - Server-Side Request Forgery

The Radio Player Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations...

Apache Druid - Server-Side Request Forgery

Server-Side Request Forgery SSRF, Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting', URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache Druid.This issue affects all previous Druid versions.When using the Druid management proxy, a request tha...