1784 matches found
CVE-2026-46380
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...
CVE-2026-46380
CVE-2026-46380 : In compliance-trestle, the HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation, enabling Server-Side Request Forgery (SSRF) to internal services or cloud metadata endpoints. Affected versions: before 3.12.2 and 4.0.3. Mitigatio...
CVE-2026-46380
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...
CVE-2026-46380: Server-Side Request Forgery (SSRF)
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...
PT-2026-75931
Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...
CVE-2026-72777
Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...
CVE-2026-72777
Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...
CVE-2026-72777 Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url
Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...
CVE-2026-72777
Next AI Draw.io
CVE-2026-72777 Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url
Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...
EUVD-2026-58198
Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...
CVE-2026-59765
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...
CVE-2026-59765 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...
EUVD-2026-58126
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...
CVE-2026-59765 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...
CVE-2026-59765
The Git repository management system Gitea (prior to version 1.27.0 ) is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause involves the use of Go's default http.Get without a custom DialContext in HTTP fetch operations, specifically within migration and OAuth avatar code paths. ...
CVE-2026-59765 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...
CVE-2026-72777: Server-Side Request Forgery (SSRF)
Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...
PT-2026-71729
Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...