22314 matches found
CVE-2026-85242
PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...
GHSA-4MVJ-M6J5-PMF7 unstructured: Server-Side Request Forgery in the URL-based partitioning
Summary Server-Side Request Forgery in unstructured. The url= argument of partition, partitionhtml, and partitionmd is fetched via requests.get with no host validation. The response body is returned as Element text, so this is a full-read SSRF — attackers reach loopback admin APIs, internal HTTP...
EUVD-2026-70598
PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...
CVE-2026-85242 Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture
PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...
SSRF (Server-Side Request Forgery) fast-uri Dependency in Bitbucket Data Center
This High severity SSRF Server-Side Request Forgery vulnerability was introduced in version 9.4.12 of Bitbucket Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows an unauthenticated...
GHSA-6F9W-9HF2-5RG3 CKAN MCP Server: Information disclosure via verbose error reflection
Summary Error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a non-CKAN response, or when an internal exception occurs, the caller...
CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL
Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...
CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL
Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...
CVE-2026-85172
n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present,...
CVE-2026-85164
WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the setapiuserImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal...
CVE-2026-85124
@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...
CVE-2026-76177
Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory...
UBUNTU-CVE-2026-76177
Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory...
CVE-2026-85172 n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass
n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present,...
CVE-2026-85163
AVideo through commit c91b5975d is affected by a Server-Side Request Forgery (SSRF) vulnerability in its EPG parser . An authenticated uploader can supply an internal URL via the epg_link parameter during video upload; the value is validated only for syntax and later fetched server-side during EP...
CVE-2026-85124 @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments
@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...
CVE-2026-76177 Multiple vulnerabilities in Ocsreports for OCS Inventory NG
Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory...
CVE-2026-76177
Ocsreports for OCS Inventory NG contains a Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint. The root cause is insufficient validation of the HTTPS_SERV and FILE_SERV parameters, allowing an authenticated user with operator privileges to supply ...
CVE-2026-76177 Multiple vulnerabilities in Ocsreports for OCS Inventory NG
Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory...
