DEBIAN-CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

EUVD-2026-95126

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

CVE-2026-107362 Server-Side Request Forgery in Malcolm

Malcolm file-upload component ships the upstream FilePond PHP server pqina/filepond-server-php largely unmodified: Dockerfile copies all upstream .php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an...

PT-2026-108114

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 7.1.4 FFmpeg versions 8.0.x prior to 8.0.2 Description A server-side request forgery issue exists in the ff rtsp connect function within libavformat/rtsp.c. The software follows RTSP 3xx redirects without validating th...

NPM: Ghost: Server-Side Request Forgery in Bookmark Fetching

NPM: Ghost: Server-Side Request Forgery in Bookmark Fetching vulnerability discovered by ? in WordPress Npm ghost versions = 6.54.1, 6.65.0...

Next.js has Server-Side Request Forgery in Image Optimization

Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery e.g. to private IPs during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns see https://nextjs.org/docs/app/getting-started/imagesremote-images for hosts that may n...

NPM: Next.js has Server-Side Request Forgery in Image Optimization

NPM: Next.js has Server-Side Request Forgery in Image Optimization vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.3.8...

GHSA-CJQ9-62Q9-8JV4 Next.js has Server-Side Request Forgery in Image Optimization

Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery e.g. to private IPs during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns see https://nextjs.org/docs/app/getting-started/imagesremote-images for hosts that may n...

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger vulnerability discovered by ? in WordPress Npm ghost versions = 1.18.0, 6.27.0...

Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and...

Adminer <4.7.9 - Server-Side Request Forgery

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized...

CVE-2026-106032

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...

Security Bulletin: Due to use of QOS.CH logback, IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution

Summary Due to use of QOS.CH logback IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution CVE-2024-12801, CVE-2024-12798. Those issues were addressed by IBM Cloud Pak System v2.3.6.2. Vulnerability Details CVEID:CVE-2024-12801 DESCRIPTION: Server-Side Reque...

CVE-2026-105438 O2OA General url ActionUploadExcelWithUrl server-side request forgery

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /xgeneralassemblecontrol/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack...

CVE-2026-105438 O2OA General url ActionUploadExcelWithUrl server-side request forgery

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /xgeneralassemblecontrol/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack...

CVE-2026-105438

A Server-Side Request Forgery (SSRF) vulnerability exists in O2OA versions up to 10.0.1-ce . The flaw is located in the General Module within the function ActionUploadExcelWithUrl at the file path /x_general_assemble_control/jaxrs/excel/upload/with/url. An attacker can achieve SSRF by manipulatin...