CVE-2024-47167-Environment-Setup

Components: 1. gradiocontainer: hosts internal HTTP server on port 5678 2. targetinternalserver: launches a python app using vulnerable version of gradio 4.40.0...

Postiz < 2.21.3 - Unauthenticated Server-Side Request Forgery

Postiz before 2.21.3 exposes an unauthenticated GET /public/stream endpoint that fetches a user-supplied URL and returns its response; a weak mp4 suffix check allows requests to internal HTTP services. id: CVE-2026-34577 info: name: Postiz 2.21.3 - Unauthenticated Server-Side Request Forgery...

CVE-2025-29927-Nextjs-Bypass-PoC

PoC: CVE-2025-29927 - Next.js Middleware Bypass This repository contains a Proof of Concept PoC demonstrating how to bypass middleware security checks in Next.js v13.5.6 by exploiting a vulnerability related to internal HTTP headers. Vulnerability Overview: CVE-2025-29927 What is it? CVE-2025-299...

CVE-2026-123818: InternLM lmdeploy: LMDeploy is a toolkit for compressing, deploying, and serving large language models

LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, issafeurl validates remote media URLs with urlparse while requests.Session.get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation...

CVE-2026-88980

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend GET /artifacts/get route accepts source=http or source=https with caller-controlled bucket and key values, and isAllowedResourceName permits an all-digit decimal host...

AZL-111523 CVE-2026-118766 affecting package botan2 2.14.0-2

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make o...

CVE-2026-118766 Botan: Online OCSP redirects enable blind requests to internal HTTP services

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make o...

CVE-2026-118766

The Botan C++ cryptography library (versions prior to 3.13.0 ) contains a vulnerability in its online OCSP client . The client allows a single HTTP redirect when processing an OCSP request directed at a URI in a certificate's Authority Information Access extension. An attacker or a malicious OCSP...

CVE-2026-118766 Botan: Online OCSP redirects enable blind requests to internal HTTP services

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make o...

CVE-2026-118766 Botan: Online OCSP redirects enable blind requests to internal HTTP services

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make o...

CVE-2026-113728 Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...

CVE-2026-113728

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...

Bulwark Mail webmail server request forgery vulnerability

Versions of Bulwark Mail’s webmail prior to 1.9.2 have a server-side request forgeing vulnerability. This vulnerability stems from the unauthenticated POST /api/fetch-ical endpoint using a check-first-pattern approach; DNS verification and socket connection resolution are inconsistent, which may...

CVE-2026-78231

The software Gitea is vulnerable to a blind Server-Side Request Forgery (SSRF) when OpenID sign-in is enabled. The root cause is that Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to a caller-supplied OpenID provider endpoint during verification. An attacker ...

PT-2026-111346

Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

PT-2026-111347

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

EUVD-2026-92754

Ghost: Server-Side Request Forgery in Bookmark Fetching...

EUVD-2026-92755

Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses...

GHSA-R7F2-6FJ8-6FG2 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned...

GHSA-RVM3-566M-V7FV Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Impact Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path /capacitorhttpinterceptor is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed...