Lucene search
+L

862 matches found

Vulnrichment
Vulnrichment
added 2026/08/05 6:59 a.m.9 views

CVE-2026-71210 mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access

Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...

5.3CVSS5.2AI score0.00157EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/05 6:59 a.m.40 views

CVE-2026-71210 mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access

Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...

5.3CVSS0.00157EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/04 9:16 p.m.11 views

CVE-2026-54020

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname again at connection time. An authenticat...

6.3CVSS0.00213EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/08/04 7:59 p.m.9 views

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and do...

7.1CVSS5.6AI score0.00222EPSS
SaveExploits0References4Affected Software1
OSV
OSV
added 2026/08/04 7:59 p.m.6 views

GHSA-8X5V-CPV7-8JJP Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and do...

7.1CVSS5.6AI score0.00222EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/04 7:59 p.m.10 views

CVE-2026-70485 Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.isglobal to the literal IPv6 address without examining IPv4 addresses embedded in...

7.1CVSS5.4AI score
SaveExploits0References5
CVE
CVE
added 2026/08/04 7:59 p.m.65 views

CVE-2026-70485

CVE-2026-70485 – Open WebUI : Affected versions 0.9.0 through 0.11.0 of the Open WebUI self-hosted AI platform check whether a user-provided URL is globally routable by applying ipaddress.is_global to the literal IPv6 address, without considering embedded IPv4 in transition encodings. In NAT64 de...

7.1CVSS5.5AI score0.00222EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/04 7:59 p.m.35 views

CVE-2026-70485 Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.isglobal to the literal IPv6 address without examining IPv4 addresses embedded in...

7.1CVSS0.00222EPSS
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/04 11:37 a.m.29 views

Malicious code in @cacheable/net (npm)

npm/@cacheable/net version 2.1.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

5.9AI score
SaveExploits0References6
NVD
NVD
added 2026/08/01 1:17 p.m.8 views

CVE-2026-67311

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...

8.2CVSS0.00256EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/08/01 12:22 p.m.10 views

CVE-2026-67311

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...

8.2CVSS5.5AI score0.00256EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/01 12:22 p.m.11 views

EUVD-2026-51822

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...

8.2CVSS5.5AI score0.00256EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/01 12:22 p.m.8 views

CVE-2026-67311 Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...

8.2CVSS5.5AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/01 12:22 p.m.37 views

CVE-2026-67311 Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...

8.2CVSS0.00256EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/31 12:00 a.m.19 views

PT-2026-66837

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

3.1CVSS5.5AI score0.00182EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/30 7:38 p.m.36 views

CVE-2026-67530 WACRM: SSRF via the automation `send_webhook` action

WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation sendwebhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the...

6.4CVSS0.00156EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/30 7:38 p.m.6 views

CVE-2026-67530 WACRM: SSRF via the automation `send_webhook` action

WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation sendwebhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the...

6.4CVSS5.6AI score
SaveExploits0References4
NVD
NVD
added 2026/07/30 7:18 p.m.11 views

CVE-2026-66415

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to filegetcontents in the Blueprints::import method without path validation. Attackers can...

8.5CVSS0.00284EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/07/30 5:01 p.m.12 views

CVE-2026-64870

MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.updatetool passes caller-supplied downloadurl and downloadcallbackurl values to requests.get without equivalent trusted-host and redirect validation, allowing an authenticated workspace user...

5.3CVSS5.9AI score0.00215EPSS
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/07/30 5:01 p.m.10 views

CVE-2026-64870 MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation

MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.updatetool passes caller-supplied downloadurl and downloadcallbackurl values to requests.get without equivalent trusted-host and redirect validation, allowing an authenticated workspace user...

5.3CVSS5.9AI score
SaveExploits0References4
Rows per page
Query Builder