CVE-2024-48360

CVE-2024-48360 | Qualitor = v8.24 Unauthenticated SSRF CVE-2024-48360 | Qualitor = v8.24 Unauthenticated SSRF Description Qualitor is a platform for business process management, and this system is present in various companies in Brazil that can be identified simply by using Google dorking. Our te...

CVE-2026-108939

A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function isglobalip of the file mistralrs-server-core/src/mediasource.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been...

PT-2026-111844

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

CVE-2026-110100: Missing Authorization

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse getheaders an...

PT-2026-111415

Name of the Vulnerable Software and Affected Versions conductor-oss conductor version 3.22.0 Description An issue exists in the MCP Service component within the MCPService.listTools function. A remote attacker can perform server-side request forgery SSRF—a technique that allows an attacker to...

UBUNTU-CVE-2026-108735

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxyurl. Attackers can point proxyurl at loopback or internal hosts, bypassing FETCHERALLOWPRIVATENETWORKS checks to probe internal...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Axios vulnerabilities (USN-8638-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8638-1 advisory. Ameer Assadi discovered that Axios did not properly handle certain hostnames when applying NOPROXY rules. An attacker...

UBUNTU-CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

CVE-2026-108939 EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery

A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function isglobalip of the file mistralrs-server-core/src/mediasource.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been...

CVE-2026-108939 EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery

A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function isglobalip of the file mistralrs-server-core/src/mediasource.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been...

CVE-2026-108939

The EricLBuehler mistral.rs library (versions up to 0.9.3 ) is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The flaw exists in the is_global_ip function within the mistralrs-server-core/src/media_source.rs file, where manipulation of the ip argument allows for remote exploita...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF to LFI Exploit ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY This proof-of-concept exploit is provided for educational purposes to help security professionals understand the vulnerability and protect their systems...

CVE-2024-5736

CVE-2024-5736 AdmirorFrames Joomla! Extension 5.0 - Server-Side Request Forgery Timeline Vulnerability reported to vendor: 26.01.2024 New fixed 5.0 version released: 06.06.2024 Public disclosure: 28.06.2024 Description Server-Side Request Forgery in AdmirorFrames Joomla! Extension in afGdStream.p...

EUVD-2026-97682

Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling linkpreviewconfig on /crawl requests. Attackers can supply a controlled page with includeexternal and includepatterns set, causing AsyncUrlSeeder to fet...

CVE-2026-85951

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 deployed on Azure are vulnerable to a server-side request forgery (SSRF) (CWE-918). This vulnerability allows an authenticated attacker to access internal cloud services, which could lead to the unauthorized acquisition ...

CVE-2019-8451

CVE-2019-8451 https://jira.atlassian.com/browse/JRASERVER-69793 http://host:port/plugins/servlet/gadgets/makeRequest?url=http://:@'.formathost, port, target https://host:port/plugins/servlet/gadgets/makeRequest?url=https://:@'.formathost, port, target...

CVE-2026-108836

A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to t...

CVE-2026-108836 Ollama Pull API name.go IsValid server-side request forgery

A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to t...

CVE-2026-108836 Ollama Pull API name.go IsValid server-side request forgery

A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to t...

CVE-2024-54385

CVE-2024-54385 Radio Player = 2.0.82 - Unauthenticated Server-Side Request Forgery Description The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This...