CVE-2026-61572

AVideo, a video-sharing platform, is vulnerable to unauthenticated full-response Server-Side Request Forgery (SSRF) . The root cause lies in objects/functions.php, where url_get_contents accepts caller-controlled destinations following only basic syntax validation, failing to block private, loopb...

CVE-2026-81889 elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...