CVE-2019-19781

CVE-2019-19781 批量概念驗證用 使用限制 1.使用前資料夾內需包含"data.txt"檔案，內容為192.168.1.0/24\n 192.168.2.0/24\n 2.僅在linux下執行， python3 CVE-2019-19781-testbata.py 3.若可成功執行並發現漏洞，匯出於"CVE-2019-19781.txt"...

nmap

Nmap Nmap is released under a custom license, which is based on but not compatible with GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products. See Nmap Copyright and Licensing for...

Project-Deep-Focus

Deep Focus 一种高性能网络侦察工具，用于跨IP范围发现和指纹识别服务。专为安全研究人员和网络管理员设计。 目录 1. 概述 2. 特性 3. 需求 4. 安装 5. 使用 6. 配置 7. 理解导出的日志 8. 目标选择指南 9. 故障排除 10. 许可 概述 Deep Focus 是一款为大规模服务发现设计的异步网络扫描器。它能智能探测常见网络服务，并为每个发现的服务提供详细的认证状态信息。你可以把它看作你的个人 mini Shodan 。 该工具针对被动散热系统（如 Apple M 系列笔记本）进行了优化，内置热管理功能，当系统负载过高时会自动降低扫描速率。 主要功能 扫描...

EUVD-2026-75184

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch...

ai-bot-ip-ranges

Rangos de IP de Bots de IA Una colección de rangos de IP oficiales de los rastreadores de bots de IA de los principales proveedores. Descripción general Este repositorio rastrea y agrega los rangos de direcciones IP publicados por los proveedores de IA para sus rastreadores web. Estos rangos son...

CVE-2026-87999

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...

CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...

PT-2026-89176

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open webui/retrieval/web/utils.py treated Python's globally routable address classification as proof...

awsScrape

AWSScrape AWSScrape 是一款工具，用于从所有 AWS IP 范围中抓取 SSL 证书，并在证书的通用名称（CN）、组织（O）和组织单位（OU）字段中搜索特定关键字。 安装 1. 克隆此仓库： root@kitploit: git clone https://github.com/jhaddix/awsscrape.git cd awsscrape 用法 按以下方式运行脚本： root@kitploit: go run awsscrape.go -keyword= Argument| Description ---|--- -keyword| 在 SSL...

CVE-2026-9081

IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery SSRF vulnerability in the validatemodelproviderkey function for the Ollama provider. The function accepts a user-supplied OLLAMABASEURL parameter and passes it directly to requests.get without...

@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition

Hi Novu team, Reporting an SSRF blocklist gap in the shared validateUrlSsrf guard. A complete self-contained reproduction is inlined below — copy the four files into a directory and run docker compose up, plus a single-file probe that runs against Node directly. Locally validated against HEAD...

CVE-2026-65056

CVE-2026-65056 describes a server-side request forgery in mcp-webresearch 0.1.7. The vulnerability arises because visit_page validates only URL protocol and does not filter private or reserved IP ranges, enabling an attacker to access internal network services by supplying loopback, link-local, o...

CVE-2026-46415

The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used r.RemoteAddr when evaluating whether a request should be blocked. RemoteAddr is the address of the immediate peer...

CVE-2026-62242 Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...

PT-2026-56088

Name of the Vulnerable Software and Affected Versions flyto-core affected versions not specified Description An issue exists in the Server-Side Request Forgery SSRF protection mechanism within src/core/utils.py. The is private ip function and validate url ssrf guard only check for native RFC 1918...

foreman: Foreman: Information disclosure via improper validation of nested request parameters

A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomyscope controller method does not properly validate organization and location IDs from nested request parameters,...

CVE-2026-5138 Foreman: foreman: information disclosure via improper validation of nested request parameters

A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomyscope controller method does not properly validate organization and location IDs from nested request parameters,...

CVE-2026-54353

Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation permissions can bypass Budibase's SSRF blacklist through DNS rebinding. The outbound fetch flow validates a hostname against the blacklist before the request is sent, but the actual socket connectio...

CVE-2026-28385 SSRF via image import from URL allows internal network probing by authenticated users

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery SSRF vulnerability in the image import functionality allows authenticated users with the cancreateimages entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a...

CVE-2026-46348

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, the list of disallowed IP address ranges was lacking an IP address range that can be used to reach local IP addresses. An attacker can use an IP address in the affected range to make...