CVE-2026-67620 Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

Denial Of Service (DoS)

axios is vulnerable to Denial of Service DoS. The vulnerability is due to the fetch adapter failing to enforce maxBodyLength for unknown-length ReadableStream request bodies, which allows an attacker to bypass upload size limits and cause excessive network or resource consumption...

CVE-2026-67620: Server-Side Request Forgery (SSRF)

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

PT-2026-69209

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description A server-side request forgery SSRF issue exists in the SSRF guard within httpSecurity.ts because the DEFAULT DENY LIST fails to include the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 a...

@vertexa/prisma (>=7.8.0, <=7.9.1), @vertexa/prisma-engines (>=7.8.0, <=7.9.1) potentially affected by unknown CVE via @vertexa/prisma-fetch-engine (7.9.1)

@vertexa/prisma-fetch-engine NPM version 7.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on @vertexa/prisma-fetch-engine and may be impacted: - @vertexa/prisma =7.8.0, =7.8.0, =7.9.1 Source cves: unknown CVE Source advisory:...

Smarty: Symlink path traversal out of trusted directories

When Smarty's Security policy is enabled, securedir and the configured template/trusted directories restrict which local files a template may read via include and fetch. The trust check in Security::checkDir resolved the requested path with Smarty::realpath, which normalizes the path as a string...

Malicious code in forge-gas-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b1f6143f5a7c6106ab4ba0a21a6adaf9020e332835b1e528de6f36b64537734 index.js is advertised as a Foundry gas-report diff utility but on module load / CLI run schedules a setTimeout of 259,200,000 ms 3 days that calls...

CVE-2026-48079 OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...

Malicious code in vite-plugin-cleaner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35bc445ea196f979ad69189f4498586a09a51855b97e95dea02d01d197620237 package.json declares an optionalDependency vite-cleaning-tools pointing at github:vite-plugins/vite-cleaning-tools with no commit SHA or tag, so npm...

Malicious code in golaaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13 The package's main module cdpinject.js runs on require. It disables TLS certificate verification process-wide...

SUSE CVE-2026-67317

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource...

CVE-2026-34966

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-34966

Gitea before 1.27.0 is affected by a server-side request forgery (SSRF) in HTTP fetch operations used by migration and OAuth avatar paths (Go http.Get without a custom DialContext). An authenticated user can supply arbitrary URLs through release asset downloads, PR patch URLs, or OAuth avatar end...

CVE-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-55524 PraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)

PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the webcrawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with...

MAL-2026-13379 Malicious code in statist-browser-typed-client-sme.rko.tariffs.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d52851f17c7c1a340dd9999cf89369ffffd6fbe5bac9aa1b441bdc42ce320067 On require of this package, index.js loads compat.js which selects a platform-specific payload path, fetches an opaque binary over HTTPS from one of...

JLSEC-2026-1164 Deno: `fetch()` API sandbox bypass via missing DNS resolution check

Summary When fetch was called, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP,...

CVE-2026-70605

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redire...