EUVD-2026-25118

WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the url schema field accepts any string without protocol restriction or destination validation. Attackers who can create or modify integrations can set webhook URLs to internal network...

PT-2026-34778

OpenClaw before 2026.3.31 lacks browser-origin validation in HTTP operator endpoints when operating in trusted-proxy mode, allowing cross-site request forgery attacks. Attackers can exploit this by sending malicious requests from a browser in trusted-proxy deployments to perform unauthorized...

FreeBSD : Gitlab -- vulnerabilities (73b927a6-3ecd-11f1-be20-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 73b927a6-3ecd-11f1-be20-2cf05da270f3 advisory. Gitlab reports: Cross-Site Request Forgery issue in GraphQL API impacts GitLab CE/EE GitLab...

PT-2026-34735

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery SSRF protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP DENY LIST for axios and...

PT-2026-34665

SocialEngine versions 7.8.0 and prior contain a blind server-side request forgery vulnerability in the /core/link/preview endpoint where user-supplied input passed via the uri request parameter is not sanitized before being used to construct outbound HTTP requests. Authenticated remote attackers...

OpenClaw 跨站请求伪造漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.31 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from a lack of browser source verification at the HTTP operator endpoint when running in a...

PT-2026-34792

OpenClaw before 2026.3.28 contains an SSRF guard bypass vulnerability that fails to block four IPv6 special-use ranges. Attackers can exploit this by crafting URLs targeting internal or non-routable IPv6 addresses to bypass SSRF protections...

Microsoft Purview 代码问题漏洞

Microsoft Purview is a data security and management software developed by the American company Microsoft. There is a code vulnerability in Microsoft Purview, which stems from server-side request forgery. This vulnerability allows unauthorized attackers to escalate their privileges through the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: munge (UTSA-2026-014299)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014299 advisory. MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in...

CVE-2026-39087

ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs...

PT-2026-34757

CVE-2026-26150 Server-side request forgery ssrf in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network. https://t.co/iDqEazYdOv...

CVE-2025-70994

Yadea T5 Electric Bicycles models manufactured in/after 2024 have a weak authentication mechanism in their keyless entry system. The system utilizes the EV1527 fixed-code RF protocol without implementing rolling codes or cryptographic challenge-response mechanisms. This is vulnerable to signal...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.28 contained security vulnerabilities. These vulnerabilities were due to a SSRF protection bypass exploit, which failed to block four IPv6 special-purpose ranges. Attackers coul...

PT-2026-34762

Name of the Vulnerable Software and Affected Versions Microsoft Entra ID Entitlement Management affected versions not specified Description Server-side request forgery SSRF in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network. This flaw...

📄 SocialEngine 7.8.0 Server-Side Request Forgery

SocialEngine versions 7.8.0 and below suffer from a blind server-side request forgery vulnerability. User input passed through the uri request parameter to the /core/link/preview endpoint is not properly sanitized before being used as URL to send an HTTP request from the web server...

PT-2026-36883

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.0.2 Description The PUT upload handler in httpserver/updown.go lacks Cross-Site Request Forgery CSRF token validation. CSRF is a type of attack that tricks a victim into submitting a malicious request. This deficiency...

PT-2026-34759

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics 365 Online affected versions not specified Description A server-side request forgery SSRF allows an unauthorized attacker to perform spoofing over a network. SSRF is a flaw where an attacker can force a server-side applicati...

Microsoft Dynamics 365 Online 代码问题漏洞

Microsoft Dynamics 365 Online is a management software developed by Microsoft Corporation, designed for monitoring employee behavior and analyzing work efficiency. There are code vulnerabilities in Microsoft Dynamics 365 Online, which stem from server-side request forgery. These vulnerabilities m...

PT-2026-34823

Summary The fetch call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts line 28 uses the default redirect: 'follow' behavior. This allows the Cloudflare Worker to follow HTTP redirects to arbitrary URLs, bypassing the isRemoteAllowed domain allowlist chec...

hackage-server 跨站请求伪造漏洞

hackage-server is a Haskell open-source package repository server. hackage-server has a cross-site request forgery vulnerability. This vulnerability stems from the lack of protection against cross-site request forgery attacks, which may allow external scripts to trigger requests, enabling the abu...