CVE-2026-111418

A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service . The root cause is that the service supports ZIP-formatted input , which can be used to bypass restrictions on requests to internal IP addresses. This could potentially allow ...

CVE-2025-14260

Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network...

EUVD-2025-211206

Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network...

Server-Side Request Forgery (SSRF)

A2A Java SDK is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of push notification destination URLs and unrestricted redirect handling, which allows an unauthenticated attacker to make the server send HTTP requests to internal or restricted...

Server-Side Request Forgery

Apache Camel is vulnerable to Server-Side Request Forgery. The vulnerability is due to the AS2 component taking the MDN destination address from the inbound message without validation, where it uses that address as the destination for the outgoing receipt and a remote partner can supply an...

Server-side Request Forgery (SSRF)

Overview Crawl4AI is a 🚀🤖 Crawl4AI: Open-source LLM Friendly Web Crawler & scraper Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the SSLCertificate.fromurl process. An attacker can access internal network resources and obtain SSL certificate information ...

Oracle Java SE security vulnerabilities

Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27 versions; Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1 versions; as well as Oracle GraalVM Enterprise Edition 21.3.19.1.1 contain security vulnerabilities. These vulnerabilities are due to issues with the ImageI...

Oracle Java SE security vulnerabilities

Oracle Java SE 25.0.4.1 and 27 versions have security vulnerabilities. These vulnerabilities stem from issues with the Compiler component, which may allow unverified attackers to access network resources through various protocols, potentially leading to unauthorized access to certain accessible...

Linux Distros Unpatched Vulnerability : CVE-2026-100104

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain...

BIT-GITLAB-2026-100104 Server-Side Request Forgery (SSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

PT-2026-115850

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

CVE-2026-100104

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

UBUNTU-CVE-2026-100104

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

CVE-2026-100104

GitLab CE/EE versions 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are vulnerable to a Server-Side Request Forgery (SSRF) . The flaw is caused by a time-of-check to time-of-use race condition during URL validation while performing repository import operations . This could allow ...

CVE-2026-100104 Server-Side Request Forgery (SSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

CVE-2026-100104 Server-Side Request Forgery (SSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

CVE-2026-100104: Server-Side Request Forgery (SSRF)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the ffrtspconnect function in libavformat/rtsp.c when RTSP 3xx redirects are followed without validating the Location URL. An attacker can access internal network resources by hosting a malicious RTSP...

Server-side Request Forgery (SSRF)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the IP address validation logic in request-external.js, which fails to correctly classify certain IPv6 transition addresses IPv4-compatible ::/96, IPv4-mapped...

CVE-2026-106557

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDo...