Ghost: Mobiledoc image-size fetch SSRF

Impact When re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card a...

MAL-2026-11526 Malicious code in nagix-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8ce2f0b04a8b6a69d540678c440c14c0c4b9b5a6cf6a957e020aceff239c279 package.json declares "postinstall": "node test.js", which auto-executes on npm install and invokes two exported routines in index.js. The first...

MAL-2026-11525 Malicious code in nagix-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c77b8796f45d4e9888fe751dac62ad9f85334f29a64d8b0b2f50377611d6fc package.json declares postinstall: node test.js, which auto-executes on npm install and performs three attacker-beneficial actions against the...

Open WebUI: DNS Rebinding SSRF Bypass

Summary Open WebUI vetted user-supplied URLs by resolving the hostname once and rejecting private, loopback and link-local addresses, then let the HTTP client resolve that hostname again at connect time. An attacker who controls the authoritative DNS for a hostname they submit can answer with a...

CLSA-2026-1776299664 TuxCare security update for npm-registry-fetch (1 CVE)

TuxCare rebuilt npm-registry-fetch to address 1 CVE. Fixed in 3.9.1-tuxcare.1...

CLSA-2026-1775003169 TuxCare security update for node-fetch (1 CVE)

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 2.6.1-tuxcare.1...

CLSA-2026-1775003167 TuxCare security update for node-fetch (1 CVE)

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.6.3-tuxcare.1...

CLSA-2026-1775003170 TuxCare security update for node-fetch (1 CVE)

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.7.3-tuxcare.1...

linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect

Summarylib.url.fetch follows HTTP redirects followredirects=True. httpx strips only Authorization and Cookie when a redirect crosses the origin, so any other caller-supplied credential header a session token such as Redfish's X-Auth-Token, an API key, ... was still sent to the redirect target. A...

datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

SummaryWhen datamodel-code-generator fetches a remote schema and follows an HTTP redirect, it re-sends the original request headers, including any Authorization header, to the redirect target even when the redirect changes origin host/port/scheme. Credentials that an operator scoped to a trusted...

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

SummaryThe administrator-configured WEBFETCHFILTERLIST the allow/block list applied to server-side web fetches: RAG URL ingestion, URL-to-markdown, web-search content fetch matches hostnames incorrectly, so the filter can be bypassed. Detailsisstringallowed backend/openwebui/utils/misc.py matches...

PYSEC-2026-3603 Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

Summary The administrator-configured WEBFETCHFILTERLIST the allow/block list applied to server-side web fetches: RAG URL ingestion, URL-to-markdown, web-search content fetch matches hostnames incorrectly, so the filter can be bypassed. Details isstringallowed backend/openwebui/utils/misc.py match...

PYSEC-2026-3580 Nanobot contains a server-side request forgery vulnerability in the web_fetch tool

Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the webfetch tool that allows remote attackers to reach internal or private network hosts by supplying a URL that redirects to a loopback or private address via a 3xx Location header. Attackers can exploit the...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Vitejs Vite

CVE-2026-39363 – Vite Dev Server Arbitrary File Reading PoC A...

PT-2026-74463

TuxCare rebuilt npm-registry-fetch to address 1 CVE. Fixed in 3.9.1-tuxcare.1...

PT-2026-74250

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.6.3-tuxcare.1...

PT-2026-67854

Name of the Vulnerable Software and Affected Versions Google::Auth versions prior to 0.09 Description Google::Auth for Perl allows server side request forgery SSRF and credential exfiltration due to unvalidated URLs read from the credentials JSON. The library fails to check hosts against the...

PT-2026-74252

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 2.6.1-tuxcare.1...

PT-2026-74253

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.7.3-tuxcare.1...

CVE-2026-67598 Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...