CVE-2026-51385

CVE-2026-51385 CVE-2026-51385 的安全公告。需要发布它，因为 GRAPHIFY 既未识别该公告也未将其发布，而 MITRE 已分配 CVE-2026-51385，本文档即为该漏洞的公告。 ES: 这是我的第一个 CVE。说实话，我找到了一种破坏 ANTI SSRF 函数逻辑的方法，而且我真的很想发布我的第一个 CVE 所以我想了想它如何影响安全性以展示影响，尽管执行起来很复杂（在真实实例中发生这种情况很复杂，但有可能，因此其复杂度为 high）。我将其提交给 MITRE，他们接受了。这就是该公告。 EN: 这是我的第一个 CVE。说实话，我自己找到了破解...

CVE-2026-72784

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

CVE-2026-72784 Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

EUVD-2022-39949

Malicious code in bioql PyPI...

HackerOne: Server Side Request Forgery (SSRF) in webhook functionality

Server Side Request Forgery SSRF vulnerability found in webhook functionality. Attacker able to bypass anti-SSRF protections by using IPv6 address mapped to IPv4. This allowed unauthorized access to internal AWS EC2 metadata instance...

CVE-2022-37313

OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record...