EUVD-2026-72539

Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the...

Identificador-CVE-2018-11759

Other language git - pt-BR Check if your instances are expose the CVE 2018-11759 The archive main are a script in bash for exploiting. The urls shall use the protocol and complete addres, example: https://test.site.com.br For more urls in one consult, can be used the here-document, example:...

CVE-2026-33626-Lab

CVE-2026-33626 — LMDeploy 视觉语言 SSRF 实验环境 概述 本仓库重现了 CVE-2026-33626 ，即 LMDeploy 视觉语言图像加载路径中的服务器端请求伪造（SSRF）漏洞。 漏洞行为发生在 LMDeploy 接收图像 URL 时，服务器端图像加载器在不正确阻止内部、私有、回环或链路本地地址的情况下直接获取该 URL。 本实验环境对比： 服务| 版本| 用途 ---|---|--- vuln| LMDeploy 0.12.0| 展示存在漏洞的行为 patched| LMDeploy 0.12.3| 展示修复后的行为 internal| 本地金丝雀服...

CVE-2026-82268

Qwen-Agent through 0.0.34 contains a server-side request forgery (SSRF) vulnerability in its document parsing path (qwen_agent/tools/simple_doc_parser.py). Caller-supplied paths are treated as URLs without scheme restriction or host validation , allowing an unauthenticated attacker to reach the G...

CVE-2026-72591

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

CVE-2026-72591

The CVE-2026-72591 entry describes a server-side request forgery (SSRF) in the gabehf/Koito project up to v0.3.2. An authenticated user can supply a crafted image_url in PATCH /apis/web/v1/album/{id}/image, causing the server to perform HTTP requests to arbitrary internal or external hosts. The i...

EUVD-2026-55215

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

CVE-2026-72566

Summary: CVE-2026-72566 is an SSRF vulnerability in automatisch (through commit 41f3c56) where a low-privileged authenticated user with the 'manage Flow' permission can cause the server to fetch arbitrary URLs via the HTTP Request app's Custom Request action, exposing the full HTTP response body ...

EUVD-2026-54961

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

CVE-2026-71211

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

CVE-2026-71211 mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

CVE-2026-71211

MLflow’s AI Gateway allows an auth_config.api_base value to be stored without validation (scheme/host/IP range), and the gateway proxy endpoint then issues HTTP requests to api_base plus a caller-supplied path, returning the response body. The existing SSRF guard (_validate_webhook_url) is never ...

CVE-2026-71211 mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

SUSE CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

Linux Distros Unpatched Vulnerability : CVE-2026-69198

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is...

Open WebUI: DNS Rebinding SSRF Bypass

Summary Open WebUI vetted user-supplied URLs by resolving the hostname once and rejecting private, loopback and link-local addresses, then let the HTTP client resolve that hostname again at connect time. An attacker who controls the authoritative DNS for a hostname they submit can answer with a...

CVE-2026-70479

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEBLOADERENGINE=playwright, the Playwright web loader validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated...

CVE-2026-70479 Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEBLOADERENGINE=playwright, the Playwright web loader validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated...

DEBIAN-CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...