98 matches found
CVE-2026-85650
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...
CVE-2026-85691
MegaParse 0.0.55 contains an unauthenticated server-side request forgery (SSRF) in the POST /v1/url endpoint, which fetches caller-supplied URLs server-side without requiring authentication. Attackers can supply internal service URLs or cloud metadata endpoints and read their responses directly f...
blind-ssrf-chains
Introduction Server Side Request Forgery SSRFใจใฏ๏ผ Server Side Request Forgery๏ผSSRF๏ผใฏใใตใผใใผใซไปปๆใฎใชใฏใจในใใไปฃ่กใใใใใจใใงใใ็ถๆ ใๆใใพใใใตใผใใผใใชใฏใจในใใๅฎ่กใใใใใใใใใฏใผใฏไธใฎไฝ็ฝฎใซใใฃใฆใฏๅ ้จใชใฝใผในใซใขใฏใปในใงใใๅฏ่ฝๆงใใใใพใใใฏใฉใฆใ็ฐๅขใงใฏใๆฉๅฏใฎ่ช่จผๆ ๅ ฑใใทใผใฏใฌใใใๅซใๅฏ่ฝๆงใฎใใใกใฟใใผใฟใจใณใใใคใณใใๅญๅจใใใใใSSRFใฏใใ้ๅคงใชใชในใฏใใใใใใพใใ ใใฉใคใณใSSRF...
CVE-2026-84207 Heym before 0.0.98 SSRF via WebSocket endpoints
Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket...
EUVD-2026-69295
Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket...
CVE-2021-40438-POC
ๆณจ๏ผๆ่ฒ็ฎ็ใใใณ็ฎก็ใใใใในใ็ฎ็ใฎใฟใๅฏพ่ฑกใจใใฆใใพใใ่จฑๅฏใๅพใฆใใใทในใใ ใงใฎใฟใในใใใฆใใ ใใใ CVE-2021-40438 - SSRFใจใฏในใใญใคใ root@kitploit: โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโ/โโโโโโโโโโโโโโโโโโโ/โโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ ไฝฟ็จๆนๆณ root@kitploit: ๅบๆฌ็ใชไฝฟใ...
wargame_Re-LS
CVE-2025-0184 DOCX SSRF CTF Challenge Quick Start root@kitploit: 1. ์ค์ ๋ฐ ๋น๋ make setup make build 2. ์๋น์ค ์์ make up 3. ์น ์ ์ open http://localhost:8080 ็ฎๆจ ๅ ้จใฎAdminใตใผใใน๏ผ3003็ชใใผใ๏ผใซใขใฏใปในใใฆใใใฉใฐใๅๅพใใฆใใ ใใ๏ผ Expected Flag : CTFflagreadme ใจใฏในใใญใคใ root@kitploit: cd exploits python3 exploitgenerator.py...
CVE-2026-79659 Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo
Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata...
CVE-2026-77775 Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation
Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. resolveopenaiupstreambase in headroom/proxy/handlers/openai.py accepts the header value, requires only that it parse with an http or https scheme and a hostname, and returns it for use ...
EUVD-2026-63904
Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. resolveopenaiupstreambase in headroom/proxy/handlers/openai.py accepts the header value, requires only that it parse with an http or https scheme and a hostname, and returns it for use ...
CVE-2026-77775 Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation
Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. resolveopenaiupstreambase in headroom/proxy/handlers/openai.py accepts the header value, requires only that it parse with an http or https scheme and a hostname, and returns it for use ...
PT-2026-79067
Name of the Vulnerable Software and Affected Versions unstructured versions 0.4.7 through 0.23.x Description The library fails to validate the host when fetching the url argument in the partition, partition html, and partition md functions. This allows an attacker to force the server-side ingesti...
CVE-2026-70666
CVE-2026-70666 is a Server-Side Request Forgery (SSRF) in Lemur (Netflix's TLS certificate manager), rated CVSS 7.4 HIGH . Two defects combine: the acme_url allowlist is validated only at authority creation, not on the PUT /api/1/authorities/ update path, and the ACME client follows server-suppli...
CVE-2026-70666 Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder,...
CVE-2026-73307
Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows.ts. A builder with the AI...
CVE-2026-73247
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...
CVE-2026-67346
Swarms 6.8.1 is affected by a server-side request forgery in the _is_safe_url function due to hostname validation via DNS resolution. This allows attackers to supply user-controlled image or audio URLs resolving to private, loopback, or metadata addresses to reach internal services and exfiltrate...
CVE-2026-17192
A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin. This issue was discovered...
CVE-2026-17534 Kimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects
Kimi Code @moonshot-ai/kimi-code before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call for example via prompt injectio...
DNS Rebinding
9Router is vulnerable to DNS Rebinding. The vulnerability is due to inconsistent DNS validation during image fetching, where the image URL is validated and fetched using separate DNS resolutions, allowing attackers to exploit DNS rebinding to access internal HTTP services...