CVE-2026-77972 safeurl validated address is not bound to the request, allowing DNS rebinding

Time-of-check Time-of-use TOCTOU Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected. Validation returns a verdict and not the address it approved, so the HTTP clients the library ships receive t...

EUVD-2026-78675

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

CVE-2026-91967

AVideo through 29.0 contains a blind server-side request forgery (SSRF) vulnerability in the getHeaderContentTypeFromURL function, which issues get_headers() calls guarded only by format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links, trigg...

CVE-2026-91967 AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL

AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues getheaders calls guarded only by format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links, triggering...

CVE-2026-91967 AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL

AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues getheaders calls guarded only by format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links, triggering...

EUVD-2026-78643

AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues getheaders calls guarded only by format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links, triggering...

CVE-2026-91967 AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL

AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues getheaders calls guarded only by format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links, triggering...

CVE-2026-91966 AVideo through 29.0 Unauthenticated SSRF via Host Header

AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the checksiteavailability function that accepts attacker-controlled HTTP Host headers. Attackers can send requests to submitIndex.php or ajax.php with arbitrary Host headers to probe internal network host...

CVE-2026-91966 AVideo through 29.0 Unauthenticated SSRF via Host Header

AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the checksiteavailability function that accepts attacker-controlled HTTP Host headers. Attackers can send requests to submitIndex.php or ajax.php with arbitrary Host headers to probe internal network host...

CVE-2026-91943 Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where getpdfpath re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access...

CVE-2026-91943 Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where getpdfpath re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access...

EUVD-2026-78800

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where getpdfpath re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access...

CVE-2026-91943

Crawl4AI before 0.9.3 is affected by a server-side request forgery (SSRF) vulnerability in PDFContentScrapingStrategy , where the _get_pdf_path() function re-downloads targets using Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal networ...

CVE-2026-91938 Flowise before 3.1.4 Server-Side Request Forgery via document loaders

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...

CVE-2026-91938 Flowise before 3.1.4 Server-Side Request Forgery via document loaders

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...

CVE-2026-79425

An authenticated Server-Side Request Forgery SSRF in the /adminapi/file/onlineupload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request...

CVE-2026-59973

CVE-2026-59973 is a bypass of a prior SSRF fix in FrontMCP 's OpenAPI adapter. The affected packages are mcp-from-openapi (2.3.0–2.5.0) and frontmcp / @frontmcp/adapters (1.2.1–1.5.0). The loadOpenAPISpec() function forwards untrusted OpenAPI URLs to OpenAPIToolGenerator.fromURL() / fromJSON(), w...

CVE-2026-59973 mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec forwards untrusted OpenAPI url and spec inputs and...

CVE-2026-54637 Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult, storeHost copies tho...

CVE-2026-91924

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection...