Metabase_CVE-2021-41277

MetabaseCVE-2021-41277 Description Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs...

PT-2026-90522

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...

NPM: n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

NPM: n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...

n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

Impact Instance AI credential setup accepted a credential test/verification URL without checking it matched the workflow node's origin. Exfiltration required the user to actively inject an attacker-controlled URL into the setup flow. The patch derives the credential destination from the node's ow...

EUVD-2026-75431

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP Link header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Becaus...

CVE-2026-86074 n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a us...

CVE-2026-86074 n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a us...

CVE-2026-86074

n8n (open-source workflow automation platform) prior to 2.37.7 and 2.38.2 is affected by a flaw in the Instance AI credential setup flow . The flow accepted a credential test or verification URL without verifying it matched the workflow node's origin, allowing attacker-controlled fetched content ...

CVE-2026-83543 Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint

The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response...

CVE-2026-83543 Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint

The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response...

CVE-2026-85650

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

EUVD-2026-69894

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...

DEBIAN-CVE-2026-53683

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

SUSE CVE-2026-84199

Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...

PT-2026-84653

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The reset password.html page parses query string parameters and uses the url parameter as a redirection target via window.location = url following a password...

EUVD-2026-69034

Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...

CVE-2026-84199 Kyverno before 1.16.2 SSRF via APICall Feature

Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...

CVE-2026-82866 @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to...

CVE-2026-82866

@pdfme/common before 5.5.10 contains a server-side request forgery (SSRF) vulnerability in the getB64BasePdf function. When the basePdf template field is attacker-controlled, the function fetches arbitrary URLs without validation, allowing attackers to force servers or clients to request internal...