62 matches found
CVE-2026-114620
A flaw was found in Authlib. A remote attacker can trigger Server-Side Request Forgery SSRF by submitting an unvalidated request URI parameter in an authorization request. Because the library forwards client-supplied addresses to internal retrieval handlers without enforcing destination policies ...
CVE-2026-25946
When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can...
CVE-2026-25946
Summary An unauthenticated Server-Side Request Forgery SSRF vulnerability in Gitea's OpenID authentication allows any remote attacker to make arbitrary HTTP requests to internal network services. This enables internal port scanning, service fingerprinting, and access to localhost-only resources...
UBUNTU-CVE-2026-107698
FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...
CVE-2026-105743
A flaw was found in docling. A remote attacker can exploit a Server-Side Request Forgery SSRF vulnerability by providing crafted URLs when remote resource fetching is enabled. Incomplete validation allows requests to be resolved again by the network client, enabling techniques such as Domain Name...
CVE-2026-102145
An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...
CVE-2026-102138
An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation...
EUVD-2026-90277
An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation...
CVE-2026-102138 Kiteworks Core Server-Side Request Forgery (SSRF)
An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation...
EUVD-2026-90381
An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...
CVE-2026-102145 Kiteworks Core Server-Side Request Forgery through CRLF Injection
An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...
PT-2026-103578
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated administrator can force the server to send requests to and interact with internal network services that should not be accessible through the...
CVE-2026-102145: Improper Neutralization of CRLF Sequences
An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...
EUVD-2026-84536
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...
CVE-2026-75511 Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...
CVE-2026-75511 Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...
PT-2026-96789
Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.18.0 Description Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl. These values are processed through...
EUVD-2026-83299
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation of FTP PORT and EPRT commands...
Security Bulletin: IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [CVE-2026-17262, CVE-2026-18869]
Summary IBM i is vulnerable to a denial of service and security restriction bypass due to improper validation of commands CVE-2026-17262, CVE-2026-18869 in File Transfer Protocol FTP as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17262 DESCRIPTION: IBM i...
CVE-2026-82285
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...