345 matches found
CVE-2026-67201
V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...
CVE-2026-67201
CVE-2026-67201 describes a SSRF bypass in V’s standard library between net.urllib and net.http up to version 0.5.2. By crafting a URL with a backslash in the authority section, net.urllib.parse() can extract a trusted host for allowlists, while net.http.get() normalizes the backslash and connects...
PT-2026-65870
V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...
Server-side Request Forgery (SSRF)
Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the getbody function, which performs DNS resolution validation separately from the actual HTTP connection. An attacker can access internal...
CVE-2026-55391 datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...
CVE-2026-59931 PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...
CVE-2026-17552
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUESTURI concatenation in call. When the rewrite base is a plain string, the REQUESTURI is appended to it, with no check that the path starts with a forward slash '/'. When the rewrite base does...
CVE-2026-17534
Kimi Code @moonshot-ai/kimi-code before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call for example via prompt injectio...
CVE-2026-17534 Kimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects
Kimi Code @moonshot-ai/kimi-code before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call for example via prompt injectio...
PT-2026-65114
Name of the Vulnerable Software and Affected Versions JFrog Artifactory affected versions not specified Description An authentication handling weakness exists in internal request processing. Under specific conditions, this flaw may allow an attacker to bypass authentication and escalate privilege...
CVE-2026-63313
9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...
PT-2026-64185
Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.4.72 Description A server-side request forgery SSRF issue exists in the '/v1/web/fetch' endpoint. The endpoint accepts a user-controlled url parameter and passes it to an external scraping provider to fetch content...
EUVD-2026-46412
lmdeploy's OpenAI-compatible API server contains a server-side request forgery vulnerability that allows unauthenticated attackers to access internal services and cloud metadata endpoints by supplying a crafted imageurl that redirects to internal targets. Attackers can send a POST request to the...
CVE-2026-65056
mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visitpage tool, which only validates the URL protocol without filtering private or reserved IP...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...
UBUNTU-CVE-2026-15812
A vulnerability was found in the internal Access Control List ACL subsystem of kronosnet Version affected: = 1.34. When the framework is explicitly configured to manage dynamic links accepting network traffic from any IP address without network payload encryption, the validation architecture...