Server-Side Request Forgery (SSRF)

Angular SSR is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to Angular’s request handling pipeline trusting user-controlled Host and X-Forwarded- HTTP headers without proper validation, which allows an attacker to manipulate URL reconstruction and perform arbitrary...

CVE-2026-28680

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata IMDS or probe internal network services. This issue has been patched in...

Improper Validation of Syntactic Correctness of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input via inadequate validation of hostnames in the libsoup client. An attacker can inject malicious HTTP headers by supplying specially crafted URLs, potentially enabling HTTP smuggling o...

CVE-2026-28680 Ghostfolio: Full-Read SSRF in Manual Asset Import

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata IMDS or probe internal network services. This issue has been patched in...

CVE-2026-28680 Ghostfolio: Full-Read SSRF in Manual Asset Import

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata IMDS or probe internal network services. This issue has been patched in...

CVE-2026-28680

CVE-2026-28680 affects Ghostfolio before version 2.245.0. An attacker can abuse the manual asset import feature to perform a full-read SSRF, enabling exfiltration of sensitive cloud metadata (IMDS) and the ability to probe internal network services. The vulnerability exhibits high confidentiality...

EUVD-2026-9990

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata IMDS or probe internal network services. This issue has been patched in...

CVE-2026-28508 Idno: Unauthenticated SSRF via URL Unfurl Endpoint

Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoin...

EUVD-2026-9984

Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoin...

CVE-2026-28508 Idno: Unauthenticated SSRF via URL Unfurl Endpoint

Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoin...

CVE-2026-28508

CVE-2026-28508 affects Idno: prior to 1.6.4, a logic error in the API authentication flow and missing login requirement on the URL unfurl endpoint results in CSRF protection bypass for unauthenticated requests. An attacker can set X-IDNO-USERNAME and X-IDNO-SIGNATURE headers to trigger is_api_req...

CVE-2025-55289 Chamilo: Stored Cross Site Scripting in Skills Argumentation

Chamilo is a learning management system. Prior to version 1.11.34, there is a stored XSS vulnerability in Chamilo LMS Verison 1.11.32 allows an attacker to inject arbitrary JavaScript into the platform’s social network and internal messaging features. When viewed by an authenticated user includin...

PT-2026-23716

Name of the Vulnerable Software and Affected Versions Navtor NavBox affected versions not specified Description A remote, unauthenticated attacker can send crafted requests to the /api/ais-data endpoint, triggering an unhandled exception. This causes the server to return verbose .NET stack traces...

PT-2026-23794

Name of the Vulnerable Software and Affected Versions PinchTab versions prior to 0.7.7 Description PinchTab is a standalone HTTP server designed to provide AI agents with direct control over a Chrome browser. A Server-Side Request Forgery SSRF condition exists in the /download endpoint. This allo...

WeKan 代码问题漏洞

WeKan is an open-source dashboard application developed by WeKan. Versions 8.32 and 8.33 of WeKan have code vulnerabilities. These vulnerabilities stem from server-side request forgery, which may lead to arbitrary HTTP requests and access to internal network services...

PT-2026-23718

Name of the Vulnerable Software and Affected Versions Navtor NavBox affected versions not specified Description The software exposes sensitive configuration and operational data because of a lack of authentication on HTTP API endpoints. A remote attacker with network access can send HTTP GET...

PT-2026-23742

Name of the Vulnerable Software and Affected Versions QuickJS versions prior to 2025-12-11 Description A specially crafted JavaScript input can cause an internal assertion failure within QuickJS. This occurs in the gc decref child function of the quickjs.c file when the QuickJS interpreter qjs is...

PT-2026-23646

Name of the Vulnerable Software and Affected Versions Ghostfolio versions prior to 2.245.0 Description Ghostfolio, an open source wealth management software, contains a server-side request forgery SSRF issue. An attacker can exploit the manual asset import feature to perform a full-read SSRF. Thi...

PT-2026-23786

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.13 Description Flowise incorrectly trusts HTTP clients that set the header x-request-from: internal, bypassing authorization checks for all /api/v1/ endpoints. This allows an authenticated tenant session to invoke...

Chamilo 跨站脚本漏洞

Chamilo is an open-source learning management system developed by Chamilo. Versions of Chamilo prior to 1.11.34 contained a cross-site scripting vulnerability. This vulnerability stemmed from insufficient input validation in social networking and internal messaging functions, which could lead to...