CVE-2026-18973

A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

CVE-2026-18973

The CVE-2026-18973 entry concerns heshengtao super-agent-party (

EUVD-2026-53694

A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...

CVE-2026-18973

A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...

CVE-2026-18973 heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery

A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...

CVE-2026-34966

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-34966

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-34966

Gitea before 1.27.0 is affected by a server-side request forgery (SSRF) in HTTP fetch operations used by migration and OAuth avatar paths (Go http.Get without a custom DialContext). An authenticated user can supply arbitrary URLs through release asset downloads, PR patch URLs, or OAuth avatar end...

CVE-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-66885

Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4 in...

CVE-2026-55523

PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.webcrawltools.webcrawl function is vulnerable to server-side request forgery. While it validates the initially supplied URL and blocks direct loopback and private destinations, its default httpx...

CVE-2026-55524

PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the webcrawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with...

CVE-2026-55524 PraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)

PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the webcrawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with...

CVE-2026-66885

Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4 in...

CVE-2026-66885 Livebook Teams identity callback lacks state binding, allowing login CSRF

Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4 in...

CVE-2026-66885 Livebook Teams identity callback lacks state binding, allowing login CSRF

Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4 in...

CVE-2026-55523 PraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targets

PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.webcrawltools.webcrawl function is vulnerable to server-side request forgery. While it validates the initially supplied URL and blocks direct loopback and private destinations, its default httpx...

EUVD-2026-53582

PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.webcrawltools.webcrawl function is vulnerable to server-side request forgery. While it validates the initially supplied URL and blocks direct loopback and private destinations, its default httpx...