RLSA-2026:77018 Important: python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230

CVE-2026-20230 Cisco Unified Communications Manager SSRF Arbitrary File Write to RCE PoC Derivation Process and Reflection Scope: This content is intended solely for local test environments, authorized reproduction environments, vulnerability verification, and protection rule analysis. Do not use...

MAL-001

MAL-001: FreeMarker Server-Side Template Injection in Liferay Portal An issue was discovered in Liferay - Portal =7.4.3.12-ga12. By inserting malicious content in the FTL Templates, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects ...

CVE-2024-54330

CVE-2024-54330 Hurrakify bfdibc85r04ky96cie05dfzjjgigz...

CVE-2022-46364-htb-ctf

DevArea SOAP Exploitation Tool CVE-2022-46364 Description This specialized exploit targets the DevArea environment on Hack The Box. It leverages a critical vulnerability in Apache CXF 3.2.14 CVE-2022-46364 to perform Local File Inclusion LFI and Server-Side Request Forgery SSRF. The script abuses...

Apache HTTPd Windows UNC - Server-Side Request Forgery

SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note- Existing configurations that access UNC paths will have to configure new...

CVE-2025-55182_liyon

CVE-2025-55182 - React Server Components RCE ⚠️ Legal Notice : This tool is intended solely for security research, authorized penetration testing, and educational purposes. Using this tool against any system without explicit permission is illegal and unethical. 📋 Overview CVE-2025-55182 is a...

CVE-2026-83548-SonicWall-SMA1000-Analysis

CVE-2026-83548 — SonicWall SMA1000 Vulnerability Analysis A cybersecurity project exploring a real-world vulnerability,its potential impact,and how security teams can detect,fix,and verify the issue. Project Overview This project is part of my cybersecurity learning journey. I selected...

CVE-2026-75898

CVE-2026-75898 — RAGFlow Invoke component SSRF Server-Side Request Forgery CWE-918 in RAGFlow's agent workflow "Invoke" component, before 0.26.3. | ---|--- CVE| CVE-2026-75898 CVSS| 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Fixed in| v0.26.3 Fix commits| c4fe68e, e16d1a0 Issue refs|...

cve-2026-4257

CVE-2026-4257 This exploits CVE-2026-4257, a Server-Side Template Injection SSTI vulnerability in the "Contact Form" Wordpress plugin by Supsystic in versions 1.7.36 and before. This vulnerability allows an unauthenticated attacker to achieve Remote Code Execution. The vulnerability exists in the...

halo-2.25.4-CVE-2026-67919

Authenticated Remote Code Execution RCE via Unvalidated Plugin URI Installation in Halo 2.25.4 1. Vulnerability Summary A critical security vulnerability has been identified in Halo version 2.25.4. The application provides an administrative endpoint to install or upgrade plugins from a remote URI...

CVE-2026-33154

Dynaconf SSTI Vulnerability Report Summary Dynaconf is vulnerable to Server-Side Template Injection SSTI due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed...

CVE-2026-26801-pdfmake-ssrf

pdfmake SSRF Vulnerability PoC Vulnerability Summary Field| Value ---|--- Package| pdfmake Version| = 0.3.0-beta.2, CREDENTIALS LEAKED! This proves the vulnerable server made an outbound request to our controlled endpoint. Full Read SSRF npm run exfiltrate The a...

GitLab-SSRF-CVE-2021-22214

CVE-2021-22214 POC for CVE-2021-22214: Gitlab SSRF Description The remote GitLab install contains a Server-side request forgery SSRF vulnerability as a result of the internal network for webhooks being enabled. A remote, unauthenticated attacker can exploit a registration-limited GitLab instance...

DEBIAN-CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

CVE-2026-25731

Server-Side Template Injection SSTI in Templite Engine Severity: High CVSS 7.8 Affected Software: calibre Patched In: 9.2.0 Advisory: GHSA-xrh9-w7qx-3gcc Summary A Server-Side Template Injection SSTI vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user...

CVE-2026-34724

🚨 CVE-2026-34724 - Zammad 7.0.1 - Server-Side Template Injection SSTI to Remote Code Execution RCE via AI Agent 📌 Overview Zammad is a popular open-source web-based helpdesk and customer support system. CVE-2026-34724 is a Server-Side Template Injection SSTI vulnerability in the new AI Agent...

EUVD-2026-95126

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...