halo-cve-2026-67919

rce del plugin de halo desde una url la consola de halo permite a los administradores instalar y actualizar plugins pegando una url. obtiene cualquier url, instala el jar, y el código del jar se ejecuta en el servidor. no hay comprobaciones de esquema, ni de host, sigue redirecciones, y el gestor...

CVE-2026-54689

CVE-2026-54689 affects mcp-searxng , a Model Context Protocol (MCP) server providing AI assistants with web search and URL-reading via SearXNG. The vulnerability lies in the hardened-mode SSRF protection in src/url-reader.ts: when MCP_HTTP_HARDEN is enabled and private URLs are not explicitly all...

EUVD-2026-78208

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CVE-2026-79723 Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints...

PT-2026-88959

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

CVE-2026-85691 MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...

CVE-2026-85691

MegaParse 0.0.55 contains an unauthenticated server-side request forgery (SSRF) in the POST /v1/url endpoint, which fetches caller-supplied URLs server-side without requiring authentication. Attackers can supply internal service URLs or cloud metadata endpoints and read their responses directly f...

CVE-2026-85163

AVideo through commit c91b5975d is affected by a Server-Side Request Forgery (SSRF) vulnerability in its EPG parser . An authenticated uploader can supply an internal URL via the epg_link parameter during video upload; the value is validated only for syntax and later fetched server-side during EP...

PT-2026-84995

AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epg link parameter during video upload, which is validated only for syntax an...

CVE-2026-82660

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

CVE-2026-82660

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

UBUNTU-CVE-2026-82660

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

CVE-2026-82866 @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to...

CVE-2026-82866

@pdfme/common before 5.5.10 contains a server-side request forgery (SSRF) vulnerability in the getB64BasePdf function. When the basePdf template field is attacker-controlled, the function fetches arbitrary URLs without validation, allowing attackers to force servers or clients to request internal...

CVE-2026-82866 @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to...

CVE-2026-82660 Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

CVE-2026-82660

Nodemailer before version 8.0.9 is affected by an access-control bypass in jsonTransport during message normalization. The disableFileAccess and disableUrlAccess options are not enforced, allowing an attacker to read local files or fetch arbitrary URLs by supplying crafted path or href values in ...

CVE-2026-82660 Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

EUVD-2026-68438

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

CVE-2026-82660 Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...