CVE-2026-103243 LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints

LightLLM through 1.2.0 fails to validate imageurl and audiourl parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error...

PT-2026-103541

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0 Description A Server-Side Request Forgery SSRF weakness allows a remote, unauthenticated attacker to force the gateway to send crafted requests to internal or unintended network...

VulnCheck KEV: CVE-2023-54402

iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value testtoken to bypass authentication. Attackers can exploit the unrestricted URL scheme handlin...

CVE-2026-102904

A flaw was found in JupyterLab. When processing extension uninstallation requests, user-supplied package names are passed to the underlying package manager without properly filtering command-line options. An authenticated user with extension management access can exploit this argument injection...

CVE-2026-100297 Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network. This may expose internal information or leak data via DNS queries...

CVE-2026-100297 Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network. This may expose internal information or leak data via DNS queries...

CVE-2026-100289

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

CVE-2026-100289

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

EUVD-2026-89026

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

CVE-2026-100289

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

Security Bulletin: Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

Summary Langflow contains multiple Server-Side Request Forgery vulnerabilities across several components where authenticated users can supply attacker-controlled URLs or database connection strings that reach internal network hosts without adequate validation. The LMStudio model and embeddings...

CVE-2026-33234

我如何将 AutoGPT 的邮件功能变成内部网络扫描器 CVE-2026-33234 | 中危 5.0 | GHSA-4jwj-6mg5-wrwf 作者： Pavan Nallamothu 我在 AutoGPT Platform 中逐一映射了所有触及网络的用户可控输入。HTTP 层被封锁得严严实实。私有 IP 范围（10.0.0.0/8、172.16.0.0/12、192.168.0.0/16）、回环地址、云元数据端点——全部被列入黑名单。我从多个角度确认了 HTTP 网关的防护。没有任何东西能穿透。 然后我打开了 SendEmailBlock 的配置模式。 SMTP...

CVE-2026-101913

A flaw was found in ip-address. The library fails to validate the complete range of IPv6 link-local addresses during address classification checks. A remote attacker can provide a specially crafted IPv6 address to bypass security controls that rely on this verification. Successful exploitation ca...

CVE-2026-55160

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

CVE-2026-55160 Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

EUVD-2026-88400

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

hikvision-unauthenticated-rce-cve-2021-36260

海康威视 CVE-2021-36260 RCE 漏洞 漏洞描述 攻击者利用该漏洞可以用无限制的 root shell 来完全控制设备，即使设备的所有者受限于有限的受保护 shell（psh）。除了入侵 IP 摄像头外，还可以访问和攻击内部网络。 FOFA header="Hikvision" app="HIKVISION-视频监控" 使用方法 python ./CVE-2021-36260.py -u http://192.168.1.1:8080 --check python ./CVE-2021-36260.py -u http://192.168.1.1:8080 --cmd "l...

basketcraft

basketcraft este es un script que explota la vulnerabilidad CVE-2023-27163, que es un SSRF en request-baskets versión 1.2.1 SSRF en Request-Baskets CVE-2023–27163 CVE-2023–27163 representa una vulnerabilidad crítica de falsificación de solicitudes del lado del servidor Server-Side Request Forgery...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the getMediaFromRemoteUrl function. An attacker can access internal network resources or read arbitrary files by supplying a crafted remote playlist URL that points to internal HTTP endpoints or loca...

CVE-2026-100849

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...