37 matches found
anubis-fetch
anubis-fetch root@kitploit: $ nix run github:fzakaria/anubis-fetch -- https://lore.kernel.org/linux-mm/some-thread/T/ Una CLI rápida en Go para obtener URLs desde detrás de muros de prueba de trabajo de Anubis y comprobaciones de huella digital de Cloudflare — resolviendo el desafío en el propio...
CVE-2026-86503
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching...
EUVD-2026-72519
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching...
CVE-2026-86503
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching...
CVE-2026-86503
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching...
CVE-2026-86503: Server-Side Request Forgery (SSRF)
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching...
CVE-2026-85675 OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...
CVE-2026-85675
OWL 's DocumentProcessingToolkit contains a server-side request forgery (SSRF) vulnerability in the extract_document_content tool. The tool fetches caller-supplied URLs without scheme, host, or IP filtering , allowing attackers to inject malicious URLs via prompt injection and cause the server to...
CVE-2026-85675 OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...
CVE-2026-85667 xiaobei through 5.5.2 Unauthenticated Webhook Message Injection
xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhookworktool handler and exploit unvalidated media UR...
PT-2026-85577
MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...
CVE-2026-37237
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read without enforcing a maximum response...
EUVD-2026-56133
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...
CVE-2026-69078
CVE-2026-69078 affects CTI-Transmute: server-side request forgery via the evaluation report PDF rendering using WeasyPrint. User-supplied Markdown renders to HTML/PDF with unrestricted URL fetches, allowing retrieval of internal network resources and local files, and potential exposure through th...
CVE-2026-58178
The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...
LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
SummaryA Server-Side Request Forgery SSRF vulnerability exists in LMDeploy's vision-language module. The loadimage function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and...
CVE-2026-0258
The CVE-2026-0258 item concerns a server-side request forgery (SSRF) in the IKEv2 implementation of Palo Alto Networks PAN-OS. The vulnerability allows an unauthenticated attacker to cause the firewall to issue network requests to unintended destinations or trigger a denial-of-service (DoS). Affe...
CVE-2026-0258 PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching
A server-side request forgery SSRF vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a denial of service DoS condition. Panorama, Cloud NGFW and...
PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching
A server-side request forgery SSRF vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a denial of service DoS condition. Panorama, Cloud NGFW and...