jira-mobile-ssrf-exploit

CVE-2022-26135 - Jira Data CenterおよびServer向けモバイルプラグインにおけるFull-Read Server Side Request Forgery Assetnoteについて Assetnoteは、お客様の外部アセットを自動的にマッピングし、変更やセキュリティ問題を監視して、深刻な侵害を防止します。 この調査はAssetnoteのセキュリティリサーチチームによって実施されました。 製品とチームの詳細はhttps://assetnote.ioをご覧ください。 ブログ記事 この脆弱性の発見に至った手順を詳述したブログ記事はこちらからご覧いただけます。...

CVE-2026-54054

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, POST /api/files/url, is vulnerable to Server-Side Request Forgery SSRF. The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects...

CVE-2026-54054 Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, POST /api/files/url, is vulnerable to Server-Side Request Forgery SSRF. The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects...

CVE-2026-54054 Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, POST /api/files/url, is vulnerable to Server-Side Request Forgery SSRF. The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects...

CVE-2026-54054

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0 , its URL import endpoint (POST /api/files/url) is vulnerable to full-read SSRF . The HTTP downloader fetches user-supplied URLs with redirects enabled and does not validate whether the targ...

openfire-ssrf-cve-2019-18394

CVE-2019-18394: Openfire FaviconServlet SSRF Ignite Realtime Openfire 4.4.2 以前における未認証のサーバーサイドリクエストフォージェリ 管理コンソール、デフォルト TCP 9090/9091。4.4.3 で修正済み issue OF-1885。 リクエストフォージェリ: host パラメータは検証なしで送信 URL に連結されるため、 サーバーは攻撃者が選択した HTTP GET を発行する。 レスポンスの開示: HTTP 200 の場合、上流の生のボディがそのまま呼び出し元に書き戻される。...

CVE-2026-85609

Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery SSRF vulnerability in the GET /tools/site-checker endpoint apps/api/src/controllers/tools.controller.ts. The endpoint passes a user-supplied url query parameter to fetchWithRedirects and performs server-side...

CVE-2026-85609

Openpanel before 2.3.0 is affected by an unauthenticated SSRF in the GET /tools/site-checker endpoint (apps/api/src/controllers/tools.controller.ts). The user-supplied url query parameter is passed to fetchWithRedirects() without SSRF or IP validation, allowing a remote attacker to reach cloud in...

GHSA-4MVJ-M6J5-PMF7 unstructured: Server-Side Request Forgery in the URL-based partitioning

Summary Server-Side Request Forgery in unstructured. The url= argument of partition, partitionhtml, and partitionmd is fetched via requests.get with no host validation. The response body is returned as Element text, so this is a full-read SSRF — attackers reach loopback admin APIs, internal HTTP...

CVE-2026-16600

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

CVE-2026-16600 SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

Juju 安全漏洞

Juju is a canonical Juju open-source application orchestration engine. Versions 3.2.0 to 3.6.19, as well as 4.0 to 4.0.4, have security vulnerabilities. These vulnerabilities stem from the internal Dqlite database cluster failing to perform proper TLS client and server authentication. This allows...

CVE-2026-28680

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata IMDS or probe internal network services. This issue has been patched in...

CVE-2026-28680 Ghostfolio: Full-Read SSRF in Manual Asset Import

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata IMDS or probe internal network services. This issue has been patched in...

CVE-2026-24477

CVE-2026-24477 affects AnythingLLM (prior to 1.10.0) when configured with Qdrant as the vector database. The root cause is exposure of the QdrantApiKey in plain text through the /api/setup-complete endpoint, enabling an unauthenticated attacker to gain full read/write access to the Qdrant vector ...

GO-2025-4210 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login in github.com/zitadel/zitadel

ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

CVE-2025-67494 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login

ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI V2 treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This...

CVE-2025-64753 grist-core has insufficient access control in endpoints for comparisons between documents and versions

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...

CVE-2024-12450

In infiniflow/ragflow versions 0.12.0, the webcrawl function in documentapp.py contains multiple vulnerabilities. The function does not filter URL parameters, allowing attackers to exploit Full Read SSRF by accessing internal network addresses and viewing their content through the generated PDF...

CVE-2024-12450

CVE-2024-12450 affects infiniflow/ragflow 0.12.0, where web_crawl in document_app.py does not filter URL parameters, enabling Full Read SSRF to access internal addresses via the generated PDFs, and allows Arbitrary File Read through the file:// protocol. The underlying Chromium headless is used w...