CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

EUVD-2026-93433

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105790 Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinnedaddresses only to...

CVE-2026-105790 Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinnedaddresses only to...

CVE-2026-105790 Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinnedaddresses only to...

CVE-2026-105790

Prior to version 3.0.9 , the Microsoft UFO framework is vulnerable to a Server-Side Request Forgery (SSRF) . Authenticated device registration via /api/devices allows an attacker to provide a controlled WebSocket endpoint. Because aip/transport/websocket.py only applies pinned_addresses to the in...

Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

Summary Before Langflow 1.10.3, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses...

GHSA-J8F7-X8JM-WMM4 Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

Summary Before Langflow 1.10.3, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 7

New Red Hat Single Sign-On 7.6.13 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of none. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 9

New Red Hat Single Sign-On 7.6.13 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of none. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...

BIT-APACHE-2026-63045 Apache HTTP Server: mod_proxy_ftp PASV address handling

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 8

New Red Hat Single Sign-On 7.6.13 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of none. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...

patch-CVE-2026-15502

补丁：CVE-2026-15502 漏洞详情 CVE ：CVE-2026-15502 产品 ：Microsoft Exchange Server 描述 ：SSRF 导致 RCE 严重性 ：严重 补丁状态：审核中 字段| 值 ---|--- 补丁日期| 2026-06-01 状态| 审核中 部署位置| 生产环境 验证方| SecOps 团队 参考资料 NVD CISA KEV...

CVE-2026-40564

CVE-2026-40564: flink-kubernetes-operator における FlinkSessionJob.spec.job.jarURI 経由の SSRF Apache Flink Kubernetes Operator は、FlinkSessionJobまたは FlinkDeploymentリソース上の spec.job.jarURI フィールドをチェックしません。これらのリソースを作成できる人は誰でも、jarURI を任意の URL に設定できます。Operator がリソースを調整reconcileする際、自身の Pod 内部からその URL...

CVE-2026-34207

CVE-2026-34207 SSRFフィルターはホスト名のテキストをチェックしていましたが、実際の接続先は後でDNSによって決定されました。このギャップにより、攻撃者が制御するWebhook URLがループバック、メタデータ、プライベートネットワークのターゲットに到達可能になりました。 はじめに この問題は、オープンソースのチャットボットビルダーであるTypebot をレビューしているときに、シンプルなセキュリティの問いを念頭に発見しました。 SSRF保護がホスト名のテキストを検証しても、実際の接続先が後でDNSによって決定されたらどうなるか？...

cosmicsting-cve-2024-34102-exploit

CosmicSting CVE-2024-34102 エクスプロイトスイート CVE-2024-34102 用の完全なエクスプロイトスイート - Adobe Commerce / Magento 2.4.x における CosmicSting XXE 脆弱性。 脆弱性の詳細 CVE : CVE-2024-34102 CVSS 9.8 タイプ : XML External Entity Injection XXE 影響 : 未認証のリモートファイル読み取り、SSRF、潜在的なRCE 影響を受けるバージョン : Adobe Commerce...

SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities

1 CVE-2026-102255 - Pre-authentication SSRF via unintended forward-proxy A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this...