EUVD-2026-104403

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetchsslcertificate=true with crafted userinfo URLs so...

CVE-2026-112363

The Crawl4AI library (versions 0.8.7 through 0.9.5 ) is vulnerable to a Server-Side Request Forgery (SSRF) within the Docker API server . The root cause stems from differences in URL userinfo parsing , allowing unauthenticated attackers to bypass destination checks. By setting fetch_ssl_certifica...

CVE-2026-112363 Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetchsslcertificate=true with crafted userinfo URLs so...

CVE-2026-112363 Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetchsslcertificate=true with crafted userinfo URLs so...

CVE-2026-112363

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetchsslcertificate=true with crafted userinfo URLs so...

CVE-2026-112296

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112291

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem path...

CVE-2026-112292

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal servertoken values and...

CVE-2026-112268

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

CVE-2026-111915

Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlist...

EUVD-2026-104277

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112296 FlyCms through commit edfdf724 Default Super Administrator Credentials

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112296 FlyCms through commit edfdf724 Default Super Administrator Credentials

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112296 FlyCms through commit edfdf724 Default Super Administrator Credentials

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112296

The FlyCms content management system (through commit edfdf724 ) is vulnerable to a default credentials vulnerability. This flaw allows unauthenticated remote attackers to gain super administrator access by logging into the flycms account using the default password admin123 via a POST request to /...

CVE-2026-112292

Versions of CheckCle through 1.6.0 are vulnerable to a missing authorization vulnerability (CWE-862) because the shipped PocketBase collections use empty API rules. This flaw allows unauthenticated attackers to query /api/collections//records endpoints to read, modify, or delete records. Potentia...

CVE-2026-112292 CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal servertoken values and...

CVE-2026-112292 CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal servertoken values and...

CVE-2026-112291 Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem path...

CVE-2026-112291 Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem path...