CVE-2026-47617

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery via DNS rebinding. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-47617

Summary (CVE-2026-47617) : NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher that could allow an attacker to perform a server-side request forgery via DNS rebinding , with potential information disclosure . The CVSS vector (Network, Low attack complexity, No privile...

CVE-2026-15307

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

CVE-2026-47616

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-47615

Summary: CVE-2026-47615 affects NVIDIA Dynamo for Linux. Affected component: server-side request forgery via a crafted URL in a multimodal request, with potential information disclosure as the impact. Root cause and exact vulnerable subcomponent are described in the NVIDIA/NVD entries. CVSSv3.1 m...

CVE-2026-47615

NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery by supplying a crafted URL in a multimodal request. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-47614

NVIDIA Dynamo for Linux contains a vulnerability (CVE-2026-47614) that could allow server-side request forgery leading to information disclosure. The NVIDIA security bulletin lists this CVE among several SSRF issues and recommends updating affected Linux releases to a newer Dynamo version (update...

CVE-2026-47614

NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-18775

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browsersnapshot of the file tools/browsertool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The...

CVE-2026-18775

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-18775 NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browsersnapshot of the file tools/browsertool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The...

EUVD-2026-52764

A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function saveurlimage of the file agent/imagegenprovider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has...

CVE-2026-18774

A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function saveurlimage of the file agent/imagegenprovider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has...

GHSA-C6XH-WV4J-PPV5 Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

Summary Flowise's HTTP security module httpSecurity.ts fails to normalize IPv4-mapped IPv6 addresses e.g., ::ffff:127.0.0.1, ::ffff:169.254.169.254 before checking them against the deny list. Due to an ipaddr.js kind mismatch ipv6 vs ipv4, all IPv4 CIDR deny rules are silently skipped for...

CVE-2026-69257

Flowise prior to v3.1.3 had an SSRF protection bypass in its HTTP security module due to improper handling of IPv4-mapped IPv6 addresses (::ffff:127.0.0.1, ::ffff:169.254.169.254). ipaddr.js categorizes these as IPv6, so IPv4 CIDR deny-list checks were skipped in isDeniedIP(), allowing requests f...

EUVD-2026-52698

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...

CVE-2026-69250 Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...

CVE-2026-70367

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...

CVE-2026-70367

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...

EUVD-2026-52687

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...