1885 matches found
CVE-2026-67620-poc
CVE-2026-67620 — Flowise SSRF via incomplete cloud-metadata deny-list Oracle OCI + Alibaba Cloud Product: FlowiseAI/Flowise — visual LLM / AI-agent builder 54k ★ Affected versions: ≤ 3.1.4 — confirmed still vulnerable in 3.1.4 , the latest release re-verified 2026-08-06 Vulnerability: Server-Side...
FormCraft3 <= 3.9.15 - Server-Side Request Forgery
Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions. id: CVE-2026-65442 info: name: FormCraft3 = 3.9.15 - Server-Side Request Forgery author: DhiyaneshDk severity: high description: | Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...
Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass
Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. id: CVE-2026-60105 info: name: Monst...
LocalAI < 4.6.0 - Server-Side Request Forgery
LocalAI before 4.6.0 is affected by an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint. The gallery url field is passed to the gallery config fetcher without validation, allowing an unauthenticated attacker to make the server issue HTTP requests to...
Gotenberg <= 8.30.1 - Server Side Request Forgery
Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression ^https?:// to match URL schemes. Because Go's net/url.Parse normalizes...
Postiz < 2.21.3 - Unauthenticated Server-Side Request Forgery
Postiz before 2.21.3 exposes an unauthenticated GET /public/stream endpoint that fetches a user-supplied URL and returns its response; a weak mp4 suffix check allows requests to internal HTTP services. id: CVE-2026-34577 info: name: Postiz 2.21.3 - Unauthenticated Server-Side Request Forgery...
Kan <= 0.5.4 - Server-Side Request Forgery
Kan, an open-source project management tool Trello alternative, versions 0.5.4 and below are vulnerable to an unauthenticated Server-Side Request Forgery in the /api/download/attatchment endpoint. The endpoint passes the attacker-controlled url query parameter straight to a server-side fetch...
MagicMirror <= 2.35.0 - Server-Side Request Forgery
An unauthenticated Server-Side Request Forgery SSRF vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment...
GeoNetwork - Server-Side Request Forgery (SSRF)
GeoNetwork versions 4.0.0 to 4.2.16 and 4.4.0 to 4.4.11 are vulnerable to an unauthenticated server-side request forgery SSRF in the SLD tool. The POST /srv/api/tools/ogc/sld endpoint accepts a caller-supplied WMS server URL and performs a server-side HTTP GetStyles request to it without any...
nextjs-cve-2026-44578
nextjs-cve-2026-44578 Nuclei templates for detecting CVE-2026-44578 Next.js WebSocket Upgrade SSRF with multi-cloud metadata validation, Next.js fingerprinting, and real-world scanning workflows. Includes references to the original NextSSRF research and exploit tooling. NextSSRF Nuclei Templates...
CVE-2025-45955
CVE-2025-45955 Server-Side Request Forgery in DonWeb Ferozo CVE-2025-45955 Description An attacker can exploit this vulnerability by uploading and executing a specially crafted PHP file on the Ferozo hosting platform. When accessed, the file launches a series of SSRF attempts targeting internal...
poc-cve-2026-32255
Kan SSRF via Attachment Download CVE-2026-32255 - Proof of Concept This repository contains a proof of concept POC for CVE-2026-32255 , a high-severity Server-Side Request Forgery SSRF vulnerability in Kan , an open-source project management tool. The vulnerable endpoint allows unauthenticated...
grafana-ssrf
grafana-ssrf Authenticated SSRF in Grafana. Notes Azure metadata header has been added to all SSRFS Google metadata header has been added to all SSRFS SSRF will not follow redirects no matter what so ensure url is direct. If login is via SSO or other none grafana logins please grab your session...
CVE-2026-33752
CVE-2026-33752 CVE-2026-33752Redirect-based SSRF leading to internal network access in curlcffi Summary curlcffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to...
CVE-2026-126379 Vvveb 1.0.8.6 SSRF via oEmbed Proxy DNS Rebinding
Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass DNS pinning by requesting non-443 URLs. Attackers can supply a rebinding hostname to the editor oEmbedProxy url parameter to read loopback services, internal panels, and cloud...
CVE-2026-126379
Vvveb version 1.0.8.6 is vulnerable to a Server-Side Request Forgery (SSRF) flaw due to an incomplete fix that allows authenticated admin users to bypass DNS pinning . By providing a rebinding hostname to the oEmbedProxy URL parameter, an attacker can request non-443 URLs to access loopback servi...
EUVD-2026-124960
OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url, or reinserted unpurified style blocks via th...
CVE-2026-34160
CVE-2026-34160 — Unauthenticated SSRF in Chamilo LMS via PENS plugin pens.php Severity : High CVSS 8.6 CWE : CWE-918 Server-Side Request Forgery Affected : chamilo/chamilo-lms 2.0-RC.2 Fixed in : 2.0-RC.3 Advisory : GHSA-g2xj-4cch-j276 NVD : https://nvd.nist.gov/vuln/detail/CVE-2026-34160 Credit ...
CVE-2026-64849.yaml
id: CVE-2026-64849 info: name: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass author: DhiyaneshDk severity: critical description: | MLflow 3.15.0 contains an information disclosure vulnerability caused by improper validation of webhook URLs allowing attackers to reach interna...
